{ "Event": { "published": true, "date": "2026-08-11", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-08-11", "timestamp": 1786492982, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "94fa56b7-7833-4389-9cc5-72d282714875", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44718c2b-9589-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786455221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786455221, "uuid": "d47d961d-2076-4ee4-b5ff-14abc35f4377", "comment": "Malware payload (Mirai)", "value": "d7c8306ee08272b991dc25cc136fe59b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786455221, "uuid": "c17f1c54-03e6-4080-80e5-1607a4197662", "comment": "Malware payload (Mirai)", "value": "004e97f82c5918b5f5ffa5fef9647e44378ae702fc498d08a9fa96cf3d5728f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786455221, "uuid": "5e4877a8-3b59-4534-8ea5-b53ecd5a0928", "comment": "Malware payload (Mirai)", "value": "83951f34cfab902902ff72c002f7cead52e945e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786455221, "uuid": "7c7570b5-9439-4a14-a055-ebc5d301f164", "comment": "Malware payload (Mirai)", "value": "92cec6d1cf299af6f7a789a7d417d52750ea4ad5de5d8cbecdc723f6758f0716acf0c94a1ba6ec439ce5594055cf2f3f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786455221, "uuid": "e8b71d28-1e9d-4af6-aa91-f714b4d58c6f", "value": "T140442946FA404A17C4D617BAFA9F42453333E764D3EB7306D928ABB03BC775A4E62502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786455221, "uuid": "95157782-c601-4c6d-8ca9-b1c9bf1ec21b", "value": "6144:zUZa9q29S5D0Ng+CxNYaLK5GMpBfEYa0iDPbHLYVV/G/m62c42s:wk9q2c5Df+CxNYaLK5GMpBfHV2Y/Qm6q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786455221, "uuid": "c2b6087b-e6f1-4d28-aef6-b3ed9c692a4d", "value": 257397, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786455221, "uuid": "4bbeef10-8e03-4070-ad0e-15aedd61fa60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786455221, "uuid": "248e720f-8027-4ada-a3c2-0abcd7bc0403", "value": "004e97f82c5918b5f5ffa5fef9647e44378ae702fc498d08a9fa96cf3d5728f9.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43946432-95d0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786485714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786485714, "uuid": "cf0d03d3-965b-45cb-9336-1b1875fcb8bc", "comment": "Malware payload (Vidar)", "value": "44f76819cf30fc6af77c97c9b17219d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786485714, "uuid": "41aba35c-b028-4b11-a4f8-811afa3381ef", "comment": "Malware payload (Vidar)", "value": "00cac49b27e8e7f132a96f18f460ffca7ae0f0c214459f02b4a000e7b755f543", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786485714, "uuid": "cc0ee789-575b-44ee-be26-2b343a76af1e", "comment": "Malware payload (Vidar)", "value": "041955673d045840e87b0775d18f94821d5e46c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786485714, "uuid": "dd0d4f2f-1d6a-46a9-9079-2fabd75c5355", "comment": "Malware payload (Vidar)", "value": "373c69206093dae47722612402cebd6c0a07496ba97db45d5558be261f5fc03ffcc63faacaa67d53f4236477a04c688c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786485714, "uuid": "552f46de-3c2b-45e4-9839-a1263ad8db00", "value": "T145565B03AE9548F5C1A9E735C8B74616BA60B80D473233E31E52BE786F723C16E35B61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786485714, "uuid": "634b3150-3b85-408a-ac98-3db07ee1b89a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786485714, "uuid": "ee764b1d-207d-4596-a2a3-5260df4e24f7", "value": "49152:G35FZf4ODVXpSIb3MegJ+EOOplMG/JQPz+uGGQnsjfXMZEArL957:G3r8XMG/rNnid+57", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786485714, "uuid": "be10335a-9496-424a-b026-18ea8f46945c", "value": 5956456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786485714, "uuid": "b15282b4-00bb-4248-b68d-d3a139028570", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786485714, "uuid": "94eb596b-f233-4c43-aa47-4e9c808fc723", "value": "00cac49b27e8e7f132a96f18f460ffca7ae0f0c214459f02b4a000e7b755f543.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37e47abd-9561-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786438020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438020, "uuid": "15c8b3cd-f640-4703-a82f-9c5a298332f8", "comment": "Malware payload (Formbook)", "value": "8dfc1da873046b08024ca0252a0036b1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438020, "uuid": "b9beb841-4ffd-465e-8295-2fb820e4df12", "comment": "Malware payload (Formbook)", "value": "01cc5dd1a9084645fd2465ae0dcb301fdc26081bfa90ca25087c4ff0580d4152", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438020, "uuid": "6e6b4b39-4128-40a1-b385-c88fe2bf8b5f", "comment": "Malware payload (Formbook)", "value": "00d2d83eb25cf7948860d8efb0e73e3daa15d56b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438020, "uuid": "8583c736-1cd6-487a-a27f-87922a041610", "comment": "Malware payload (Formbook)", "value": "74ee7a88a1652b4c388117b09b4cde749cb6657456edf0591a770b984a79d6cf64dc606ea93e02470446967e6d954b5f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438020, "uuid": "f1694b58-a9b3-4543-bd34-4d11e82db7e8", "value": "T18272553AF948DFF40B2E11D1518B7D026154A7A6743A4DFCE4CAC5587F2A7008EAB8EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438020, "uuid": "2a6c4aa2-bda6-42e1-8898-cf91426a5b5a", "value": "192:6AATomDXYS2QkgRSFx6Oy3Sj5/mcF4ljfVkqAgzy7KzguEkq3UrdOhC+r5lUn5+S:/m8SJk8SFxzysccFOc9uElk6C+FTgHSk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786438020, "uuid": "9ff15686-4094-4955-92cd-a4edba94d89d", "value": 16163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786438020, "uuid": "0c2f6924-6947-4832-97a1-8ded8685a78e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438020, "uuid": "dd490abf-53ec-472b-ac0e-cd7008ecf4eb", "value": "Booking_00120.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3851773f-958e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786457348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457348, "uuid": "81cfd915-22b5-487b-b1c4-75047a413358", "comment": "Malware payload (Mirai)", "value": "626bd6380b2e8d6eb373c34e0304d657", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457348, "uuid": "0d862837-0bf3-4310-889d-875a5c42644e", "comment": "Malware payload (Mirai)", "value": "01d8dc569e88dee98c53c19e687d67c5596215dc32f6cb618b8179621a422373", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457348, "uuid": "77bd1add-ba04-486d-a739-a363906ce8b5", "comment": "Malware payload (Mirai)", "value": "0fcd6de78a781d17bdc0076c197ede667addac6b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457348, "uuid": "bde14f78-448e-4b39-b01b-2c70af31b041", "comment": "Malware payload (Mirai)", "value": "7e19bb2d2b5811e3c789b64174bc9ba269ba1afbef2064e3d489eaafac2345cf8da09e24641dfa89f6cc54b5d7a4faa2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457348, "uuid": "72891161-a34e-48bd-abbf-0b248e95485e", "value": "T1E9D30945F8404B23C6C611BBFB5E428D3B2A17E8D3EF720399256F60378695B0E3B946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457348, "uuid": "fd921846-b952-4d7a-b0ea-1314b4d690f3", "value": "1536:wKdzElm18uZJjb0A2Fa8eAZHk4VB7fzTTXvpDg4CvmPeqZfJ20lC5wyw6RNPkT+5:wKpnI5U8e947LHvpDzCGtRJ65JKy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786457348, "uuid": "cc43d5d5-85e4-481b-93d9-b49fbf7136ce", "value": 133920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786457348, "uuid": "e1167fd2-a939-4a51-bc17-ae6cd5dafee1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457348, "uuid": "c77afa7e-5a42-441f-91a9-0f83fac3cc1c", "value": "bot.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc38f978-955d-11f1-bd95-42010a9c0009", "comment": "Malware payload (MeshAgent)", "timestamp": 1786436632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436632, "uuid": "96463604-2e48-4c5f-b7eb-8b52c8bf00cf", "comment": "Malware payload (MeshAgent)", "value": "5d487a9745d149a1699f04d4ad1ba57b", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436632, "uuid": "fd206f73-9e38-405c-8b07-4b6b3842db4c", "comment": "Malware payload (MeshAgent)", "value": "01e597990041fdcba7bea14c734b337439bd780936d9164852217f9c8da003b8", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436632, "uuid": "c446c7d1-02f5-4bc3-b887-baaba4026ef0", "comment": "Malware payload (MeshAgent)", "value": "2dea1013acc89c3dbed69b40ef44e6909048090f", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436632, "uuid": "2ce1f3f2-964e-4782-b88b-008a510ab750", "comment": "Malware payload (MeshAgent)", "value": "4fdce6721c75936fe5056ee43b6e8bc2905dcfc36c37ae2b6766b4a37cb73c33675db680dbf17edd2cbaeab6a97f7b35", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436632, "uuid": "ab5b6993-2cf9-46c2-a862-a4f3fb0db359", "value": "T16062195576BC4B1B82F022E17D4882E2E60B80DF6719E3D270E4C24FE24D55D99FA2E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436632, "uuid": "77ba2b6e-f3eb-42a3-893f-d124cf74e28e", "value": "384:NjJELOkbvZ+gns7jECnyfNkd9TzaGOOKrxr5:gLO0ZNnaxd9TzfOHrp5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786436632, "uuid": "1b449466-f204-4add-9b0d-7afd872a09fa", "value": 15341, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786436632, "uuid": "5c95720d-8e16-4856-8a94-69a819c4f457", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436632, "uuid": "f1b08975-901d-4efa-aead-3fc805655fda", "value": "grab.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd375c75-9529-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786414192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786414192, "uuid": "089c22b7-5f3f-4489-846f-26482315bf5c", "comment": "Malware payload (Mirai)", "value": "97eb2afac624fd6d5106099a32a82f07", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786414192, "uuid": "453e55ec-a95d-4d1a-8240-625b50fb2e05", "comment": "Malware payload (Mirai)", "value": "020fd6b946c52e68ea21a1533d6ed5f9f3b50fc1d19eef0c1fd6e8c18802505b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786414192, "uuid": "86da4621-f15d-4eec-ade2-12c7a5a4f7a4", "comment": "Malware payload (Mirai)", "value": "d7aced7075d85512d6583d29db2b8c6bf994c9ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786414192, "uuid": "4c2e4b0a-27a5-4997-a5ee-193320dfa365", "comment": "Malware payload (Mirai)", "value": "28941dc8a7046b9fa04f61f573b632273812b28f2e71260783982271aa0f95e81956abb920b86f2d98cca7a4a7d0dfad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786414192, "uuid": "91b9330f-cefa-42d7-9675-bcfadad2c725", "value": "T1A624C71E6E329F7DF6A9C73447B74E24975823D627E1D584E1ACD2101E2038E642FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786414192, "uuid": "abdcc524-0a4a-4aa3-89da-b7dcd9c1f6ac", "value": "3072:ceMXIUqFHiLoO/j2uhZDIa5JwQKcJlsvB+r+VZUdlAHGwyW:uXIUqFvadhZD5wQpOfVMlCGwl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786414192, "uuid": "d45d7ad4-c102-4f57-b4ac-a0aa1e21e6da", "value": 216308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786414192, "uuid": "5385f34a-be5f-4d98-8395-11e202cb6939", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786414192, "uuid": "b0cad4f0-2c2e-4e50-ac70-cf556e1dfe33", "value": "sdfjgnjsdf.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e8bc61c-95c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1786481008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786481008, "uuid": "55855c61-7eba-476d-b4af-1631228906b5", "comment": "Malware payload (Socks5Systemz)", "value": "4165b365d06809d4c927da7a050f4090", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786481008, "uuid": "9ffa24af-a75b-4b79-9b04-141b8a4ba724", "comment": "Malware payload (Socks5Systemz)", "value": "029a1ad507f87f41e00f9ab4ffe8646636b0da5965581d591e7fc61a1b42280f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786481008, "uuid": "c9897cf8-3915-4961-b24e-74dc02f8487b", "comment": "Malware payload (Socks5Systemz)", "value": "7d8b18968d43f9d0b77a99e05aa7cc675e632d45", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786481008, "uuid": "2bc5a893-a0b8-4102-8ae0-db333338b46d", "comment": "Malware payload (Socks5Systemz)", "value": "46f5e2bf6a6abbadeed692f00d10873dc4463ae19bf687132bd8de22146a77e41654bd56037e32843c9ae5e638216ff7", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786481008, "uuid": "f9c5e9b1-a770-4f77-94f3-c257c8126d66", "value": "T13016336131911C39F20ADA394FE2ED66AAF57A19ECDD30393358244EEF73040296DBD6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786481008, "uuid": "2948d5a4-1994-4bca-a896-24ab027043f6", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786481008, "uuid": "c087f9c5-98f0-4469-a4c3-162901d0fe60", "value": "98304:IO1n1MZb8zQoY5/bCcgR4UK36hOlygIjdfBHLWeUwLMU4dMn:9jgjgRnM6hUyHW2LMUwMn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786481008, "uuid": "903f9238-5e98-49aa-995e-88a7f46d6936", "value": 4331794, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786481008, "uuid": "8aa49fa1-2c9f-4b79-8968-e7128313760e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786481008, "uuid": "0cbb9f97-c234-4a89-8c1b-60367ddb4f54", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa553fc5-9569-11f1-bd95-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1786441782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441782, "uuid": "d969751e-ee9f-49a4-989e-fc33aae33a30", "comment": "Malware payload (Gafgyt)", "value": "e450ec8e485eef8655db756fa9fa4f10", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441782, "uuid": "b466309e-5279-4ddf-a0d2-fda007d4c2fa", "comment": "Malware payload (Gafgyt)", "value": "02d70eb6accd3567b63b1841e22c9646dabca3f01ab8eb021a2e666e4e0fa233", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441782, "uuid": "5c523ec6-284d-41c9-bdb7-642e4d24ab88", "comment": "Malware payload (Gafgyt)", "value": "c85709867a807bf01319bd5fed2f276fb08b2a42", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441782, "uuid": "3b3fecec-4d9f-4d4c-8ed0-9652743002f9", "comment": "Malware payload (Gafgyt)", "value": "3362608a96f43bae6581c615b36ce793a33d523f9c522e188e59c1ed1da50d0c370ac8876b53206a0b8ee64a057ab66c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441782, "uuid": "eed9c8fc-42ec-414b-ba04-a8ef2f1c43d0", "value": "T19DC30A44F941872BC2E327BAE78E438D3B355A9497DB332569386EF42FC17982D29530", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441782, "uuid": "cc4a8723-0da3-4304-85cb-67bcff3c2f45", "value": "3072:0mTe1c/r2e7rC8fVthin3b0BPz5bNmbAAQVhPRtXJfo:j/r2e7rjfVinGrmbAAQVhPRtXJfo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786441782, "uuid": "37d2efc7-59fc-47a3-964e-2b4be21e7168", "value": 123914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786441782, "uuid": "13bedad4-19cf-40d0-8274-1b2f284924fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441782, "uuid": "5cf26162-0bfd-45f3-ab92-9828eccb5fd6", "value": "p-p.c-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fba3e95-9562-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786438409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438409, "uuid": "9e112a10-4a5e-41ae-a681-a0069589d29b", "comment": "Malware payload (AgentTesla)", "value": "5537bd2fe0a2ab97f317cf280e7513b2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438409, "uuid": "e5fac8ca-e848-4ad0-94ef-56a3bdabdab1", "comment": "Malware payload (AgentTesla)", "value": "02fd5ba967b9ff948787ebcbe8c166cd401730f0286339ceaa3553b5fc794aab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438409, "uuid": "250e99ed-7ef8-4847-838c-3e6585a56642", "comment": "Malware payload (AgentTesla)", "value": "d55972c4915f96866012e7e4995db7ea4fea5f52", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438409, "uuid": "053ae483-f9ba-47dc-9e3f-b6713193d65f", "comment": "Malware payload (AgentTesla)", "value": "9bf5539419eff3af803343867d5874cb88e8ae59b06efb253143d52645d31af1d117d64ac129301dc405c796514d97ea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438409, "uuid": "1189a64f-6d59-44a0-883b-8b4e6ce30f01", "value": "T1CD95F7E275BF37471814BB8C448D3D9C4FABE92A0C4272D8F4CD1F90530A69B6694AB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438409, "uuid": "f5a75772-19de-41f7-8308-022ee72948c8", "value": "24576:4VIKgyJHBOO77bj4EOv9UsttWoZGNVDoizMbmMCN:6OO77bjmFKoZuVDoiQ6MU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786438409, "uuid": "ef316c97-f6c0-4564-81ea-9955234ae65c", "value": 1973690, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786438409, "uuid": "0ffad776-9107-4e63-8f6c-464a995c7d87", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438409, "uuid": "63f30a6d-4db9-4ee1-bda7-e3bc4ea3bf5f", "value": "CARGO DETAILS.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8c3b19e-95bc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786477401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477401, "uuid": "e931d674-9b50-4bb1-887c-29b6c2280f18", "comment": "Malware payload", "value": "92b9ef87a179677889a99828cdd629eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477401, "uuid": "6ed5ddf7-9123-4bed-bdc1-8c0d9ec1d4e5", "comment": "Malware payload", "value": "0414879174c48d347917e8a440f316ef41d49a062d5bb9519856262a579c4704", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477401, "uuid": "2938b712-7a28-429f-864b-b01b3f79bb0f", "comment": "Malware payload", "value": "cf800b031dc0f014053b84d0bcb380da2e14af65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477401, "uuid": "defd7334-605c-4826-8f1e-005a30c16be1", "comment": "Malware payload", "value": "8ac435bdf17eeca263d557b067aa41ae8dad7f461d5364fed993c5ff295bf2aeb672b25b4bc2726cd0c686ae10cffff6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786477401, "uuid": "3e13a1fb-bbc4-4a05-85c3-798dc1408071", "value": "T1B4366A03EEA548F9D296D73588774242B764BC499B3533D32E60BA742F363D0AE79B40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786477401, "uuid": "48d53c77-ae27-4b0d-99b6-8f119faf9402", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786477401, "uuid": "a6c9e090-9b94-4285-973a-9ce76f7c311f", "value": "49152:uFKpz7i7FAlc03DCBGcm+a1h6TczyJPj4RRHrYvAaa+:uc3XND1aJrCOk+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786477401, "uuid": "d1ad4f1a-f2e7-435b-aa78-b1e88d67cd95", "value": 5000567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786477401, "uuid": "b2cde998-9b6b-4f02-bab6-b3df6d834b51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786477401, "uuid": "c66c96bb-0b06-4545-bcd7-cc655a10b551", "value": "0414879174c48d347917e8a440f316ef41d49a062d5bb9519856262a579c4704.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "342ad5c7-952e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786416110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786416110, "uuid": "93b763e7-d9fb-4fef-971f-0992384c04dc", "comment": "Malware payload (Mirai)", "value": "9fc1b760bf97ce6d413920a32d76a9f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786416110, "uuid": "ef92dc75-faa9-4f27-bc4d-cc9fe40c9358", "comment": "Malware payload (Mirai)", "value": "043c227bab015892ca8043e338a49d54689ef5ae55b5ef96d74fd186a724b91f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786416110, "uuid": "2a26c027-dd62-4850-ba6f-4aeb65d3a4cf", "comment": "Malware payload (Mirai)", "value": "ea0e28bb2731947d949653280d89e1dddcd0e8f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786416110, "uuid": "70be4f75-3a86-4049-94cc-34cb357baaef", "comment": "Malware payload (Mirai)", "value": "ea7312f5493f6d0cdabbbfe5b3c93b8e43e142ab9c226b84a6a841f02bc5273b6d23cfc66823f2fa9e1e5f80f338a762", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786416110, "uuid": "160fcae8-d33d-45f7-8214-e4da7c520daa", "value": "T166631994F840DA35C7C0757AFA5E02DD73130FA8E2EA31158D25AB353BF7A194A3B942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786416110, "uuid": "743f39b2-c0bc-4293-a22f-0d61390275ec", "value": "1536:icznkgYnkaPNbs01SobMTFnjdsXTnQ9Ai94F883CIpgDbalpqzvHOoN0r:i6rm0ToDQB83CIpxqj/i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786416110, "uuid": "082e7512-cfb8-43aa-9831-6dbf55354aa6", "value": 70536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786416110, "uuid": "9d0c71c6-0558-42bf-bcba-69086d70e3a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786416110, "uuid": "06299dcc-f249-4711-a774-67de4cb65821", "value": "main.armv5-eabi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0afdd65e-9593-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786459420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786459420, "uuid": "6e0c3402-8a56-4549-a232-7dd75da6a78a", "comment": "Malware payload", "value": "38560a3ed34a92a9105f2977bb755cff", "object_relation": "md5", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786459420, "uuid": "c68349b5-5aab-4dec-877a-ac52b912559d", "comment": "Malware payload", "value": "048669cdb23f7e81d3a636b801a5dbc18b4080de1ee58e2f75bfb5a091e92f93", "object_relation": "sha256", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786459420, "uuid": "a2888b9d-724e-429e-992a-5e0c77c282b2", "comment": "Malware payload", "value": "51ed2a9e85bbad7aab18415cfa9e21758d8d3c7c", "object_relation": "sha1", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786459420, "uuid": "3002fc3f-9450-4597-bd96-a977f21d0506", "comment": "Malware payload", "value": "aee91a82ac186001b3a2621eda7ab40e2446de1b37ec30011c6429cc043cd64e861031127f6b07d7e70ef625c8e04f6c", "object_relation": "sha3-384", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786459420, "uuid": "7a594708-12fd-48ad-8a3a-21438a26b233", "value": "T183014C5CD1E4DA9109B9C987F3B09585C49094C7B1F567E6F68E1A23AF60C8E346330D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786459420, "uuid": "e6863f3f-010a-4c78-a4df-23f42a2621db", "value": "12:FH8ioNJAC7ukxGWi2jU30+0K5+A+BjuDjfypZfyNp5ZhG+E6:FH8j/wWi2jzZuDDyppyNpn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786459420, "uuid": "90e865b5-9f28-43c8-a00a-d9d0de74a718", "value": 676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786459420, "uuid": "ae8d437a-51ce-4d64-9ecb-737c051652a7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786459420, "uuid": "648b9f4c-0804-4bc5-b2ff-4556d08fa7ea", "value": "o.xml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29886be1-95b8-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1786475362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786475362, "uuid": "854bf785-1ee3-4fb2-9d76-b3bbaceba289", "comment": "Malware payload (CoinMiner)", "value": "e9ecec68eb54cfe34007e5462bddded1", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786475362, "uuid": "08e8fb32-c42a-4421-a936-05a2e58b8240", "comment": "Malware payload (CoinMiner)", "value": "052fc99f8c973cb0fe6d4dba5f92043af639496d6d96d2bba414afecf006173d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786475362, "uuid": "7ad7eae6-4738-464f-84dd-506dba533e20", "comment": "Malware payload (CoinMiner)", "value": "6d8da02907920f22438f901602858734767215a4", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786475362, "uuid": "05bc4703-d9c0-42cf-b2b1-60d450a9344c", "comment": "Malware payload (CoinMiner)", "value": "62f9ba8a0fe630402c10272118776b162b38736b485dc5b8fe4a3e6c8a7db4fe63fc474e69c942f036fa9d4867f9458f", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786475362, "uuid": "188ac236-d1a7-4d72-8cf8-69f8f7b6a52a", "value": "T1F436338AACC6D574C086C3F4425365BEB2BA7FA18170BC0B77DE29054E99E28947F7C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786475362, "uuid": "3efc6f24-7fa3-42dd-9c01-0a8e4e266c60", "value": "35171f6f6a1bfee47cbc04cb345c411f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786475362, "uuid": "684a1624-039f-4248-ba7f-940c10a3eade", "value": "98304:fXUcpByeJyu5QsFKgDgJndGed8e5op/wlgLC22kdhME0GGMN7TX2d3gFudJ3C0:fXPpfN5QqKgDq/d89pbSkZ0GGcT43gFI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786475362, "uuid": "fa35b3e0-b7c0-4a3b-95cd-ffac1cb6eb1a", "value": 5266432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786475362, "uuid": "9a3c0bf0-cd0a-444a-bff1-5b5b2f1a703d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786475362, "uuid": "c50be409-574f-49fe-97e0-a02abe91927d", "value": "052fc99f8c973cb0fe6d4dba5f92043af639496d6d96d2bba414afecf006173d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3062e3e-9590-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786458521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458521, "uuid": "e95cd9af-0507-438c-9fa7-12010b2f9f67", "comment": "Malware payload (Mirai)", "value": "96760ac1f8709cf3d64d40bc7503a1eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458521, "uuid": "256f4162-bef5-4e2b-a54b-32164eb42f6c", "comment": "Malware payload (Mirai)", "value": "05a0b65232abcbb31b06e09ce51f6bdcebc73a69969188adf693b41aefa7ba9a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458521, "uuid": "14933f67-c65f-4b7a-ad8f-4066651a5719", "comment": "Malware payload (Mirai)", "value": "aa916df0e66624e2b4dc41191856797a59a7119f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458521, "uuid": "4cb852bd-0c9d-4b32-b498-44437dc7be21", "comment": "Malware payload (Mirai)", "value": "238d3c49b59ebee6ba5b823ae76793ae956581246291fed08877aa0e35fffa8401b74bc49e44bf35a22816b8d04f9c3d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458521, "uuid": "50ad246a-0e70-4ad4-95a1-0b2cee6c6499", "value": "T157831231877E0630EB12FBF1B63C4693F94A5B65C6F43CE5A6D2B2946C02A17BC61543", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458521, "uuid": "281f4309-672b-4bdc-bc46-1e1d38bb5cb0", "value": "1536:eNdQl2YjyX9OEpSNysdrIR/auI4s/BGTZNsYLrBLnq4fMmijQu0gou:sQMYjIlpSIsdr4/auDgANsYLrBLnNUsc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786458521, "uuid": "1f167ea4-5028-452a-9c8a-0f57aa9a7735", "value": 88064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786458521, "uuid": "7ded47f8-15b1-421b-86b9-fce70e19f46e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458521, "uuid": "8c9a6d17-c403-4b27-a259-ad93bb637b8b", "value": "sdfjgnjsdf.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89052cc3-9573-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786445887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445887, "uuid": "a27cc237-af55-4169-9149-e0a59a38b32c", "comment": "Malware payload (Mirai)", "value": "888a0f97fdd8fd4679e98a4a18684cfe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445887, "uuid": "35423062-b3c0-498d-b265-97d7bcd960ee", "comment": "Malware payload (Mirai)", "value": "05ed3243004785e11e68924ec9f36d6683d03f6fa0fa845a2886fe1196523034", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445887, "uuid": "9265d83b-cf47-4746-99a6-042f91391512", "comment": "Malware payload (Mirai)", "value": "e62f769b6c7b9d4a7bc75511771db9611f54f935", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445887, "uuid": "2fe0920b-9062-48e6-8de8-019144316fa8", "comment": "Malware payload (Mirai)", "value": "8401ae56dd5bbf258a428b7b6d8e461e8c81482571f9c5f0b9d1d35c87f64400f3461e092aba6d988d390699cd3b8cf1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445887, "uuid": "6ea176b5-8c77-4aad-bb74-cbcf5ee22a21", "value": "T140B35C82E707D1F4DA5204B05057F77A9D35AA361234EA5BEBD0FDF36D32A02942A36C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445887, "uuid": "867e03d4-1e00-428a-b148-a1b48c3147cf", "value": "1536:j61n00JY6O3ItNFcKLI4Y2UrqGAKwlFDS1CS5ZM6khU6H31H4aG/8n6r:j6100JY6OgNFpLI4Y7rRAPPDSdS54P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786445887, "uuid": "7c5471d5-df70-46c0-9866-a3977ddecc8d", "value": 111232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786445887, "uuid": "77978b63-62dc-408b-b453-7fabf5960a33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445887, "uuid": "4c037471-cce7-4fe1-8ec4-6229bb823e41", "value": "sdfjgnjsdf.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81ff0d80-9560-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786437715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786437715, "uuid": "8c9cc830-8203-4b41-a5f7-b220e7bf3fcf", "comment": "Malware payload", "value": "28928c66f55a614942d1bf8b86e1e513", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786437715, "uuid": "1502d8ea-986e-4d16-87bc-e25694ccb7c8", "comment": "Malware payload", "value": "06427cd7e9759d8e67b62bacccb36f1ae3f9495dca91bae8de823c92a0ebfa19", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786437715, "uuid": "6a8b6f89-ac30-4c00-aa5c-b381dadad408", "comment": "Malware payload", "value": "131085b2278fc2beaab7f717bacc576d4b16d412", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786437715, "uuid": "a12f27fb-cd58-4710-85fc-bda67f6b2388", "comment": "Malware payload", "value": "dbce1f3d5d0d3a24eb23f52ef949c758aa5d7dde5890f154b51775feb93f29894912ab6f7db78d21d97429cc3754667b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786437715, "uuid": "84f669b8-f9c6-4bdd-a056-c3b423010d08", "value": "T18EC27D956A867C44BEC94B3E4CBD2B1D6DF5C3D1224942AC3D8A3C719C12FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786437715, "uuid": "5e88c81a-12b7-4f5a-8f87-49611d9ebb1f", "value": "768:g8vCB+25j6es8Rv29FYpMSUpi+20qUpi+20YQX:g8l25J4d2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786437715, "uuid": "1c03dd70-441a-4070-8ca5-2ac7692e9bbd", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786437715, "uuid": "513e9b82-afae-47f5-9958-ccada6233669", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786437715, "uuid": "d786ee4d-4c10-4785-9946-79f39740fee9", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff3ce9fa-95ba-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786476580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476580, "uuid": "064db4ca-512d-458b-940f-f5ea87c0aa86", "comment": "Malware payload (Vidar)", "value": "c89d2eb034c2ceb10dd66eaf866e5fc2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476580, "uuid": "c1ed0093-7a35-42c9-821b-d91e67f5330c", "comment": "Malware payload (Vidar)", "value": "064c9f58fe2ab6a050b3c4ebbcbd9653e6fef49b2ed6a287de28d47d710d8f35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476580, "uuid": "5aba7f8f-efa2-4e7f-968e-2228e42f9a37", "comment": "Malware payload (Vidar)", "value": "01c3d03d61bc8d8456c94a16890214d61072f03d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476580, "uuid": "d28e2039-6659-47c9-8986-34b9a5834c22", "comment": "Malware payload (Vidar)", "value": "8167a8157807d642b3f9134a0d313c9fbf4a27759d9341c45844a3dec2c0ce8f7fae4fb17a425514e4e0a9a87acb9ff4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476580, "uuid": "985c74a9-529d-4a2e-82fc-3c2d15e86298", "value": "T1C9367D0BBF555E65C0A9E775857A4206A728B80CCB3137E32DA1ADB43F327E25E35B10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476580, "uuid": "89399688-a147-44d9-a1eb-4fc7dd5f6213", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476580, "uuid": "5e96db5a-76a2-4760-bccf-14b97621188a", "value": "49152:vcVNKOlQt6h2lFKdlK+MoIGJyjXI55XHcVZpW8cyH/k13HGw2N40Y6MZpQooex8:vcKR0dk7kyj8c1zfYmw2N40O1Px8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786476580, "uuid": "7884ea05-7490-428f-9a46-bad90b49c7f4", "value": 5087328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786476580, "uuid": "178b99dd-09f5-4b8d-8792-375e4ed49947", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476580, "uuid": "8eca7a11-de62-4f83-8e5a-487ae0889667", "value": "064c9f58fe2ab6a050b3c4ebbcbd9653e6fef49b2ed6a287de28d47d710d8f35.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0bc3aec-957d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Amadey)", "timestamp": 1786450329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786450329, "uuid": "69830953-ecbe-429c-b4fc-50872da9bd01", "comment": "Malware payload (Amadey)", "value": "f5cf7c01852b26d95f796552210e8710", "object_relation": "md5", "Tag": [ { "name": "1TEST.file", "colour": "#584C71", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786450329, "uuid": "5432c74f-123c-4e5c-9d48-755c363662b0", "comment": "Malware payload (Amadey)", "value": "067e4d534c2c4b0808b3e895d5df93f46fed2718984d5a61e13f2a01ac610215", "object_relation": "sha256", "Tag": [ { "name": "1TEST.file", "colour": "#584C71", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786450329, "uuid": "6fcf2c6b-a443-4c0b-9e0f-0ba1d5f3e917", "comment": "Malware payload (Amadey)", "value": "f3f68a5e03a1f69453b2c4d7c58d89b3edea5791", "object_relation": "sha1", "Tag": [ { "name": "1TEST.file", "colour": "#584C71", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786450329, "uuid": "264537f9-8ce7-4802-b3d3-753df11f2510", "comment": "Malware payload (Amadey)", "value": "577f67c2f38f3f81e5704bdd81556e03827470b39ae15c7e43607641033dcff2e41fa570c73ba4e9acb7090d79ec6a68", "object_relation": "sha3-384", "Tag": [ { "name": "1TEST.file", "colour": "#584C71", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786450329, "uuid": "1ff4c1c4-413c-4285-80d7-5aecfd12dee5", "value": "T11995D13439FA502AB1B3EFA69BE475D6DA6FB7333B07645D1090038A4613A81DEC153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786450329, "uuid": "7a704132-5ff8-4adb-9fba-4b1bef2019e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786450329, "uuid": "c2f004b8-c143-4a4a-82f7-04c0b4573250", "value": "24576:xSiSdl5VWDWg26xdFo9L0hlxjp6nDS7BMN8IZ+VDiNHHwJ6pbcwoLFyX:xZSJVWDsMy9QhQS2N8+vHQOcL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786450329, "uuid": "90e0aaff-62e9-4224-80b2-73ed9abedf1e", "value": 1923072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786450329, "uuid": "b9b68c8b-79a4-42fa-be20-5b8f9dbcc3d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786450329, "uuid": "2a700e4a-852e-42ab-9e41-aa3596a6a4ed", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a829a4b-958e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786457325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457325, "uuid": "e8963d11-2468-4d9b-b811-8ea3bc87dda5", "comment": "Malware payload", "value": "2a832d0fc5cabfd5d86df3e947924f71", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457325, "uuid": "1998ab6c-8a51-461e-bd93-c473ca59659b", "comment": "Malware payload", "value": "068977c4a292851fdc31c78001c3438988f309b3ab624b853aafb1636295583f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457325, "uuid": "2cb42fb4-25ac-4d77-919d-7fd18b5af528", "comment": "Malware payload", "value": "dac5a584ef883efef9238129bb059ec3c337fd51", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457325, "uuid": "21076580-f707-427f-b890-bae5068b7839", "comment": "Malware payload", "value": "b9b8d38cea8f18ff8bf8cb34ee0d4363c35019090039149e669a0696e293126c1e4b4c92f0c049f1e79cb0b4b728985e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457325, "uuid": "8d2fd917-002e-4a63-bf9f-f73782014185", "value": "T1974162C900554A392CF29A7E31F68C98F3A1A0B730C19F8694F734B7404DE552D92E9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457325, "uuid": "a602f69e-11a2-41c0-b83c-90f3966c61cf", "value": "48:v0djm0sM9H0hdhjC0hvu0CGD01rs0YgV0c8T0v5y0DVE0SWj0gYn03v35aO:v0djm0sM9H0rNC0hvu0CGD01rs0YgV0A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786457325, "uuid": "d50702d0-ee18-4297-a2a1-caf459154692", "value": 2399, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786457325, "uuid": "118f67bd-a902-4edf-86a6-b489d9759c57", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457325, "uuid": "cacd62c3-1aaa-4dfe-a70b-b3ea71c3b4d4", "value": "gpon443", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e27ca089-9599-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786462358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786462358, "uuid": "fd778fd5-a52a-411c-b0d6-c3b5b14e93af", "comment": "Malware payload", "value": "de90e2abe2829e546a05f3dcc5105371", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786462358, "uuid": "1fc7b23a-4cb8-4073-b8fc-00fe518cb891", "comment": "Malware payload", "value": "06d78f814ef35f49b8587ca7718fc11e234e6cfad663c3198feb19a5c75842ae", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786462358, "uuid": "419b6b8c-94b6-4489-a929-5c931b2e1a09", "comment": "Malware payload", "value": "a785d05bdf822dd932a5492b81cc6b51efcc1e09", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786462358, "uuid": "859d6f74-9e83-46b3-bf20-5bfb1365b0fb", "comment": "Malware payload", "value": "aeb4be1d657c6b9577164f216fa6fdd2e66c2a69e3a6d57473f7bef9038f0ce34ae37148411d6d17e14a62eb16d68aa1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786462358, "uuid": "453c197d-7799-4ea2-89d4-da6a854cd1a3", "value": "T10FC27D96AA967C44BDC94A3E4CBD2B0D6DF5C3D1224942AC3D8B3C71DC11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786462358, "uuid": "3ccbb521-1b25-46b9-9665-b360c028469a", "value": "768:Y8vCB+25j6es8RW8E9FYpMSUpi+20qUpi+20YQX:Y8l25JQd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786462358, "uuid": "a48902e3-8cce-49f3-aab4-63f0046672a8", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786462358, "uuid": "d107d2d8-29ac-49ee-a8b1-3198b8cff067", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786462358, "uuid": "a53de8b2-bc1e-41bf-b84a-9a4672b3165c", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0665da0e-9561-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786437937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786437937, "uuid": "6911d1d5-5a06-4650-803b-0e75e52e8b92", "comment": "Malware payload (AgentTesla)", "value": "4a8faea096edf4566787997beaa2b564", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786437937, "uuid": "6b76a1ab-a7f9-4f1b-bf29-dedd01f99071", "comment": "Malware payload (AgentTesla)", "value": "07801c260e6c96b27fd4dbfaff18df7b803ea953bd76f2f022e0cee4ab613a65", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786437937, "uuid": "3b9b8d35-ab46-42df-9250-f6fa3ec35a66", "comment": "Malware payload (AgentTesla)", "value": "2d927f63e9c755a2f8ad91b0342ef14c6dc9a4a2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786437937, "uuid": "ff369fe8-cbf1-4c69-9231-0e43ad3050db", "comment": "Malware payload (AgentTesla)", "value": "ef5b402c84226309e6d9b78e267c59e819f0e71edb64a689635a7015d0777137bddddea331d855a469c0451d13f62a79", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786437937, "uuid": "83413054-6729-4c74-84e2-ff3edd31d2da", "value": "T1CC43B2B41B2CC0E3ACD9BA54C887DFD4A0787A373CE94E86555047928B2D993FDA1DC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786437937, "uuid": "bfbed866-7e34-41bb-a41f-9e927c5dd651", "value": "768:hkyKoWec+Nv3T5EnarEz76Ha1+I6zozAjRGiQoEH3gTDG1KUS6s2ixZN0f8XVpP+:KyKWRAS6mwF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786437937, "uuid": "177f77bb-7a2d-456f-8814-6b18eeced10f", "value": 59765, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786437937, "uuid": "c342aa41-c17b-435f-9959-b1ec462f89a5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786437937, "uuid": "476bbaa5-6117-47c0-92ed-10a184d6e193", "value": "RFQ 6000149727.pdf.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99e53cf1-9579-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786448493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448493, "uuid": "cd2292a4-98be-4015-98f0-23ca7d48f0b8", "comment": "Malware payload (Vidar)", "value": "be54a37ac5d344156c3fd1357b50310d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448493, "uuid": "df0cc635-d270-4f8e-9f5c-4e5ea745ab63", "comment": "Malware payload (Vidar)", "value": "079a62b56e5f91bb4cc1cb238f00a69b0a6fb827bb32119ba542a5ee6d18f4c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448493, "uuid": "bd51be51-04f5-4327-ab0e-680466512d2d", "comment": "Malware payload (Vidar)", "value": "30a11744e754541ad42fc83ae837016a2f5134ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448493, "uuid": "4d4db69a-a33e-41be-aba3-c85a4ef9155b", "comment": "Malware payload (Vidar)", "value": "28982c70afd255d372af2940c1829bfd5e83a354732e4ccaeca0289b63f21268a7b2062951f0b133de630a4d8f923df3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448493, "uuid": "5b0fc147-e7a5-4a69-900b-7ef310d347c9", "value": "T1ABF56C47EDE048EEC06AB63589F255863B36BC091B3527D32E54B7382E76BD05C3A718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448493, "uuid": "c4fc661c-451d-489e-8191-e66d96eddf1a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448493, "uuid": "3b7685b0-3fcb-4b75-b88d-2e5dd95e71e3", "value": "49152:rCx5TIKxX9dC8NbIgPJnh4abtfd5Vj4Cxc/:rCs8IgPEwtdb0qw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786448493, "uuid": "4f0f998c-00a7-4fbd-8e04-7129b0ec43b0", "value": 3631016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786448493, "uuid": "6d25dc6c-dcb4-4c32-b107-96b6f59d2f6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448493, "uuid": "28e88739-d128-4f37-82af-da5d7f2456dd", "value": "079a62b56e5f91bb4cc1cb238f00a69b0a6fb827bb32119ba542a5ee6d18f4c1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "353a1a23-958c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786456484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456484, "uuid": "c69a2dec-9ab8-4a7f-906c-e038a3753539", "comment": "Malware payload", "value": "0ee235725a9e88ba36bb94276296f605", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456484, "uuid": "92cb5483-f265-4aa7-be95-8d4b4922bf59", "comment": "Malware payload", "value": "079ca3bb2b850c0888fb66043e9222ab3d6b0d8e625edcbee3ae359d60c1c8c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456484, "uuid": "c0296c3a-c20b-4c4d-bece-cfe5379289c7", "comment": "Malware payload", "value": "b0922fb0f6344b126e7126b26cbf490eed085297", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456484, "uuid": "6abada41-d681-4644-808a-9a3037d8c914", "comment": "Malware payload", "value": "363ed24992c71db0598727148d7952e5ecdadefe4e670b9583c698893e29dc66d2907a36e57934a12132e58ca76b08d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786456484, "uuid": "584cf724-1123-4399-8220-1c7a3fcdeab3", "value": "T159A32A4B660775C4F57001F0A7CE4BD13F2360DB2B3A5EB6AC6912F7ABB319A181C652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786456484, "uuid": "5665aa18-7775-4b94-9c47-109704f00b0e", "value": "1536:fNUq2K7sacHM5ByKtTWJkxEBECvbRGLCgReUn5p5M/LW:fNUq2csXs6KtTOkxUbmCgMhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786456484, "uuid": "b50b7596-ca87-42d3-a1a7-14838452c396", "value": 99808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786456484, "uuid": "db8257ce-2f1d-44d6-bfc8-54aba3fed924", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786456484, "uuid": "8f99a83c-ee38-476d-bc37-aca855362a91", "value": "main.arc700", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0076b97d-956a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1786441793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441793, "uuid": "a80ed4e9-3140-474e-aef0-4f456cbdcda6", "comment": "Malware payload (Gafgyt)", "value": "dacb103498d59e0976f819c347312d24", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441793, "uuid": "a564cc1b-3614-4070-b76d-c45507bf662a", "comment": "Malware payload (Gafgyt)", "value": "07d24f98d34ebcd0e8fe40ea9218805c94dd500e4ed3c3a0cebf79692aa53802", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441793, "uuid": "6c9651d3-e792-4c4b-bf56-f05d350731b6", "comment": "Malware payload (Gafgyt)", "value": "b3253d8edfa50f4278d83dfc8ddfa0da25ff505a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441793, "uuid": "6f235e48-cdf9-4512-9eaa-c1adba2e5e40", "comment": "Malware payload (Gafgyt)", "value": "00937dd42bcf68052136886be1f33541baac2a2954af7755734d56f2f8e0ce1cbfa483667823eda590c062d4225263e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441793, "uuid": "5fb65219-3f09-424c-841d-9d91e473722a", "value": "T149E3965ABB619EB7DC1ECE33069A5502118CE58612E96F6FB2B4C52CF74B84F08E3C54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441793, "uuid": "1bbf6eed-d2a4-4732-bbd7-b91f34e3199e", "value": "1536:vPeTGez2Dd/4lJHKEWMko6Md3jNMZgH+spYOBLFrxLFgMWmMkdVcG1DKW01so:v8z2DYpR68MqnNF1JgfmMOVcG1DJ01so", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786441793, "uuid": "a2d620e3-be35-4805-80c4-3ef73447fdc6", "value": 151396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786441793, "uuid": "4707ef73-f158-4721-9b56-6ddb020b10c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441793, "uuid": "9d2dd0ab-13e0-4558-8a91-93ffbdd03022", "value": "m-p.s-l.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42257609-957e-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786450493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786450493, "uuid": "bd87ed71-fed1-4e1c-b291-a79d647bf2f7", "comment": "Malware payload (AgentTesla)", "value": "50c29a2225cdd6b0a7fdb712d9c36d53", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786450493, "uuid": "55988199-12a5-4b1b-a1c7-c9e089b7e9b2", "comment": "Malware payload (AgentTesla)", "value": "0846638011c26f1ad2107311aef7d359aac55e4f81477af41a80b03838ad2a70", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786450493, "uuid": "9304fb5a-555b-4c07-a719-6cbdae5b0012", "comment": "Malware payload (AgentTesla)", "value": "f0ae382162a2cf7d2e038202beb563affab65205", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786450493, "uuid": "480b7d72-79d7-4fac-aae2-3ebcd7d32599", "comment": "Malware payload (AgentTesla)", "value": "d248073d86d8de5556c9393b8cb756afa7e4e8aa6a0ff93a86f8a060315a13cdbeecf60f603958ccbfc0e702272bff51", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786450493, "uuid": "74a48ffb-7366-4fbb-84b0-b4c466a4e57a", "value": "T11FE5D5911784AC727721AB9C923ADDF0D90A551325C6DF1230ACF2187B6CD1BA79CAF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786450493, "uuid": "609f84a0-75c2-4964-b490-0843d1302f40", "value": "49152:AWy9TOgsK67pikSU7KUTc6alV9Chhj1eGuJ/N1MJs4Rl/aYC7oV+Ob5ofxG/hmjC:q9TOgsK6VfxXTQT0hBpudN2Js4Rl/aYJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786450493, "uuid": "b14feab1-820e-4a91-8856-bd9d29bdf9ac", "value": 3023678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786450493, "uuid": "558f4291-cf3d-4eeb-9e63-eae59494146c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786450493, "uuid": "bdbd933f-80fa-4c0e-8984-f932c752e941", "value": "PO.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b91be623-9523-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786411608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786411608, "uuid": "a4a28707-0ac7-4bb1-889f-ccd8f2a0213e", "comment": "Malware payload", "value": "daa73f79f7c86f182e44d8761cc7dbdd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786411608, "uuid": "d110603e-599e-411a-9f0b-4468425a247b", "comment": "Malware payload", "value": "088840155e73df853dc78841aebe420334f295a159ea5151c143ce17e4f3f4ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786411608, "uuid": "1aa661a9-fd89-4c05-923b-8f5ecd64acbe", "comment": "Malware payload", "value": "55ecbf6e570cef04f8f7ca204c5bfc3a3022c273", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786411608, "uuid": "22e2bc83-eaf0-4665-bcbc-fe81601f533d", "comment": "Malware payload", "value": "03998a5e5d304963964978831e6cc84b5fcb06f1dddfa6faf791721b637ba09e603adb12957c21493b9d066c07b3ce9d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786411608, "uuid": "015ba29d-9774-4a87-b3e1-c549f85cfff4", "value": "T1E1A35B47770B2890F86102F163DDA3E03F1561CBAF321EB7586A62F76F731991D06A62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786411608, "uuid": "4ef7a08e-f3dd-4d22-afae-6c2b88a80d5f", "value": "1536:NcXqMVJA1UtdQKzdnxjChP2h8f34jgLhCUn5p5M/LW5:iq0A1UtyPcVg8hq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786411608, "uuid": "608654a5-0d98-4c65-bb1a-3a75d96ad4cb", "value": 99828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786411608, "uuid": "c106f4ed-3e77-451c-a8cf-c5761371b779", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786411608, "uuid": "1e3c2c8d-ee3f-4a33-bfc4-0b021b066306", "value": "main.archs38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f8bea0d-95a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1786466756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786466756, "uuid": "ee0b55a2-c324-466f-b65a-66120a9f2b1c", "comment": "Malware payload (SalatStealer)", "value": "5e636ac3375d8564865fb3f6c87a25d4", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786466756, "uuid": "e91e0ba4-a46d-49f3-bb0e-f3203a683dc2", "comment": "Malware payload (SalatStealer)", "value": "08ca4ac0b2ef5742ba956cac67c58d428142998ab8be88df1b105cea5702af8d", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786466756, "uuid": "0fbc5f23-e21c-417c-89f0-41a73737537e", "comment": "Malware payload (SalatStealer)", "value": "e153ebb4f715f9f4f8ed593951c819bb027ce481", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786466756, "uuid": "32221143-dce1-43f5-8e83-2f69ef701f51", "comment": "Malware payload (SalatStealer)", "value": "35cf06079821050ebe3cd4b3f0c1a8e3e6e1742adf288f1941e6beb882040d03f259f890ff1c16cfe82dd66c1b42fbfb", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786466756, "uuid": "f1cff1eb-6444-41cb-884b-8978773fdc56", "value": "T179A6332CCE7DF151B8E78D725A72A1C6C266C6AD942F1BE8CEC0A4285365447873D33E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786466756, "uuid": "0d9bee9e-0983-419d-9234-d0b6c256c754", "value": "196608:BJsKw0UmYEGKIrJh6k24I7030k38VbwM8juG4AhVFjYrKieYEnA:BSKw0LYVKcw3tVkbuG4Av6rjb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786466756, "uuid": "f074ff85-d426-4c00-bfb1-67cad6aa4890", "value": 9627187, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786466756, "uuid": "9928101e-183f-4c29-b01c-48ff27fa2711", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786466756, "uuid": "8cd19d40-900c-40f8-bbc0-fff01ca14e54", "value": "zapret-discord-youtube-1.9.9d.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cd93ce9-9590-11f1-bd95-42010a9c0009", "comment": "Malware payload (WaterStealer)", "timestamp": 1786458376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458376, "uuid": "6083e68f-74ef-40b4-813b-185fe4110134", "comment": "Malware payload (WaterStealer)", "value": "75a4eefa373ba0f4781feda5321c84ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "WaterStealer", "colour": "#9CD6D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458376, "uuid": "bc9552de-9774-45f9-b076-0590b193f36b", "comment": "Malware payload (WaterStealer)", "value": "09475893b76fb978a0e014551c7ba7f0950f82f4f71bde536127900645a71586", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "WaterStealer", "colour": "#9CD6D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458376, "uuid": "e893e0da-8925-4db4-ae1c-5325fb58bdae", "comment": "Malware payload (WaterStealer)", "value": "1c4a5c3bdd097c297dc88b09510d8163b302b929", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "WaterStealer", "colour": "#9CD6D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458376, "uuid": "572decf4-84e4-40a0-8a50-b23e096c4bf1", "comment": "Malware payload (WaterStealer)", "value": "fd7e1da5607b66a5cb2764745286c5db7a6073bb7716109152c489d34f286705eed95775e8ba665736002a7313db7a84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "WaterStealer", "colour": "#9CD6D2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458376, "uuid": "7c2c9350-824b-4bdd-a20e-a4c610a09ccc", "value": "T19E06CF06766921D9C969C2788A0B9607D33234451335B69B67E9BB8FDFE33F0497E302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458376, "uuid": "5539b182-34fb-4445-b3fa-8ef017619f46", "value": "94005068f6ab0b44564d3db4115766c3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458376, "uuid": "e8861f56-46dd-410a-ae1c-a614314ece5f", "value": "49152:HGOVsN7jAeDO0pp3TRIjqTYosw72phYXhRfY8lr9WDrnrAPIsQ8kPI+6MG5+:n0f+YXDjIsQ8kPuv+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786458376, "uuid": "6ba333db-02cf-4646-bbaa-ae1ad706f571", "value": 3821056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786458376, "uuid": "2182f805-bcf4-461b-aacb-be130cf566ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458376, "uuid": "f5038ca7-1d8c-4980-9120-a0ee0b4c1a61", "value": "09475893b76fb978a0e014551c7ba7f0950f82f4f71bde536127900645a71586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3504f62-954c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786429181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786429181, "uuid": "34a152c5-8b68-4c34-84b5-cfcae3cc36e5", "comment": "Malware payload (Mirai)", "value": "f5168b5e4a9705add31aa2bf67e64b35", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786429181, "uuid": "3c32ce4e-ed2b-4bdf-bfee-5545adf75438", "comment": "Malware payload (Mirai)", "value": "0965425f6b955870343cefba2899695261b4431363acd7c5bb30f7d30bf4765e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786429181, "uuid": "281d6db5-c37c-47c1-88c7-5700bce239d3", "comment": "Malware payload (Mirai)", "value": "5bf3cf114af881e15550eb3367bcba9cc826cd48", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786429181, "uuid": "58c72ae4-bd8c-4275-9a6b-9f69077d5ebc", "comment": "Malware payload (Mirai)", "value": "81b639d902dc7c2b174686ec4ef384557a8e32cefa2aa361c33ba33ada83b18b53400e662bf65b0fea7bbf427c41d468", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786429181, "uuid": "af4fe969-25d8-48fe-8551-6d9910bd871d", "value": "T1F3C37CC1B24C3E9EE4933D7C820A13176E1CAE50DC93950150B5BA47DAB76E71F26ACB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786429181, "uuid": "a753d407-f233-440b-af47-eb8131e8fb11", "value": "3072:rRpI5mJ9PMutXAljHlZfNARQRGcv1Fr8+QLLjyosy:rR5Mu5CH3fNAWVv1Fw+QXvN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786429181, "uuid": "6b72a9a4-d5e5-4a52-bd65-ea26df35b7fd", "value": 125340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786429181, "uuid": "fd92d755-e932-4a16-80e6-d983beaf6ecf", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786429181, "uuid": "03493794-9dce-4b58-98a0-bf88e9d48c45", "value": "putita.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d40e4f10-9532-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786418096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786418096, "uuid": "03da4a91-5772-4687-b763-319194ec3ca6", "comment": "Malware payload", "value": "88492f91352a75a926e3b9b9820d0002", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786418096, "uuid": "49351958-bc0d-4d16-9807-bc7fdc6f477a", "comment": "Malware payload", "value": "097fef8f5e7ab4e0dae04e4e5768101659601c3797466d9f2ef6d305d75b0f3c", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786418096, "uuid": "5def5365-963c-4851-b81b-b8eee8f4ded1", "comment": "Malware payload", "value": "209bb7ad88f84501d1432cb81afbf9418e84a764", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786418096, "uuid": "d34532ea-ec76-4013-a3a7-a06433278dba", "comment": "Malware payload", "value": "90113290790c8f5812539567181067dcb096877a3406f83318f7c5b3ba654139a1d7b744398c6a39815a8806d5899778", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786418096, "uuid": "46f0027a-2a3d-4713-93fe-2c69d676925f", "value": "T1D242199CFEE1B2B0F31303CE37AB2C1A122461D72008C5C5F98D9DE57F467D98666A5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786418096, "uuid": "46cb6569-aedd-4fad-945e-c1feda37e412", "value": "192:sCHNsGeTHQpD+da6+888+UV7tDoj/pxzaK5JYb5sql5HdfIz43thO5Ho:sCX+/DV7k/3aK5WeqZfg43TO5Ho", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786418096, "uuid": "0e5ee1ba-12fe-453a-ad23-10e5d7f432b9", "value": 12152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786418096, "uuid": "02bdb073-e783-4bf1-ac67-511d6ec7450e", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786418096, "uuid": "5be493f0-92c2-4b42-a249-abf5bcd282fd", "value": "fuck_niggers_8.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60ddc211-955d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786436371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436371, "uuid": "11a9dd8a-076b-47fb-8c48-94242250cfac", "comment": "Malware payload", "value": "3a090c62c2be036a93cbbd63bd12f1c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436371, "uuid": "c256056a-c997-4909-b969-3d4d671e6530", "comment": "Malware payload", "value": "09871cd602e7f8930484f67858ced148299cfffdb25fdefd93feb3cce21cc771", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436371, "uuid": "d7dd3642-052a-441e-924e-c057086ef633", "comment": "Malware payload", "value": "6a547a669be754719d9f976779e1432254540e1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436371, "uuid": "3beea28a-45a4-4b08-b26a-2aa0034f2169", "comment": "Malware payload", "value": "08d195fc8a6ded897a0ff9226387eab4f23e385779be00295602a64f49c7185d604fe61bf54f96c01986397d82b8a22e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436371, "uuid": "018b5a7a-9fbe-435f-b3ff-6075ab45dc85", "value": "T1A0D523953CF355B0C83AC7BA9F82E8ADB82977E187B04E5376CC6A008D532196D36375", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436371, "uuid": "debc9fe3-4184-457c-88d3-5e23d90d369c", "value": "f5bec796b7b3c2932293afa8281cdeed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436371, "uuid": "f0fb1f5f-5cc0-4b33-96ba-5c73a4bf9d2c", "value": "49152:FzJrk8lVD9ZL2m2XKKjvQvQD/1J4t/HLADQI8Op2gUM5uY2Zhech71QzO54:F9RlVD9ZiKKjvQOeHLOQErz5uY2Zheef", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786436371, "uuid": "fe91c143-bce7-4f40-948f-3fbc55307af5", "value": 2962944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786436371, "uuid": "21ec8046-b64b-4d18-8c9c-b6206a01cfc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436371, "uuid": "88bc4a1e-4acd-4edb-8f85-3c8e9de84ead", "value": "9z7BGnRGpgs8cZv7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23df5904-9597-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786461179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786461179, "uuid": "0e9c6b07-419c-4f05-8139-ac85a8d9534d", "comment": "Malware payload (Mirai)", "value": "28ee62346feec9ff6a998556a8cafedd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786461179, "uuid": "0591f2be-ec97-49ff-be98-c99e2f6904b6", "comment": "Malware payload (Mirai)", "value": "09a587f626d4a5dce15c24130305d2ed13f6542f75f32f9b8e17de932691e7a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786461179, "uuid": "64a450e7-48f4-4a44-a554-bebaaa166ff9", "comment": "Malware payload (Mirai)", "value": "a6682e5b87ea5e9715e8133fe02d09081405cac4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786461179, "uuid": "e8071f0d-a481-47f6-bb04-300029661ee7", "comment": "Malware payload (Mirai)", "value": "ac197a2ad5753713c226216234c875d1e1e8101d31918f6fc0668a604c648fe45339909c4893f8259a862bb4a59527ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786461179, "uuid": "5e1ee996-a579-4212-9ad6-ea224f604eae", "value": "T14A13E126AD8CD78A907F92796D5F311F5000D903724E86FA32EC086798C9F2837B5F55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786461179, "uuid": "42bf5ce9-c2eb-45a4-b6a2-44b236dd2ce7", "value": "768:bL/I2xYyR8lYt9v39K/IWjK46nnQehw1Xa9BL1XCE0AMG6O2uD5mE3BnbcuyD7Uv:bLue9VK/IgK46hw1K9BL1XC8MG6OPDzt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786461179, "uuid": "3504e898-53ab-4675-9994-10a3ba80d882", "value": 42008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786461179, "uuid": "82cdacb7-bef3-4700-af57-ba8a890106e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786461179, "uuid": "ce653f41-c452-490d-adfc-ca2f529d3f67", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c43a753f-9595-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786460590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786460590, "uuid": "6cb33b34-a183-4d21-80af-8b3a4f67293f", "comment": "Malware payload (Mirai)", "value": "fd528436fae3cefe1620945839708f5b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786460590, "uuid": "5fe1ed79-08e5-4949-b4c1-9e8ad3b8d535", "comment": "Malware payload (Mirai)", "value": "09f59b3ac39097827c5c89a40393cece1f7f806579c6e2f2dd2592d719506687", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786460590, "uuid": "7025875b-5390-4e20-ac76-2faabd1bc4eb", "comment": "Malware payload (Mirai)", "value": "af92ff6f6ac4bcc906320200ca4dbacff684a64a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786460590, "uuid": "9414fd89-261f-4fc0-a78d-3d2b91e8745e", "comment": "Malware payload (Mirai)", "value": "133a234f607af8806ba1c2fe53e999fe6e6e61854315afb17ebcf19e92f13cc9fe80f3b45d387be937883edb26d02e7a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786460590, "uuid": "458ab6c4-8354-4d41-b6bf-5f045a640aad", "value": "T11DF38CB2C8692FA8C315A9B4B0B4CF791B639551814B1FBA617BC2B14487DCDF9063F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786460590, "uuid": "00eea050-4320-4abf-97f4-24e7f52c5130", "value": "3072:A5hE1sPb9AX0Km2HMC+SmXL/vn8zZWZ9q9L:A5hE6BTz2HM4mXLXUEZc9L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786460590, "uuid": "3e03839a-26e7-476d-82ee-9749a023eb43", "value": 158124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786460590, "uuid": "da3cbeba-4347-40dc-a471-82add2424c9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786460590, "uuid": "71045a2b-d4e1-4092-a45b-656eb8a2bb65", "value": "sdfjgnjsdf.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "912c8e3c-9548-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1786427433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786427433, "uuid": "1611cfdc-13e2-48ed-9385-a83f802576dc", "comment": "Malware payload (ConnectWise)", "value": "e74ac3731d34608653feed4a193c3385", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786427433, "uuid": "855beda5-30da-4d6c-b17e-e847c0f0c4ca", "comment": "Malware payload (ConnectWise)", "value": "0a16de6fe251f0afe91560e7193b0e7b9cc1ac80dfe714ea43f888d7ab1d7d2a", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786427433, "uuid": "9f427780-f023-43e7-8318-ec6ed19ec0d9", "comment": "Malware payload (ConnectWise)", "value": "100ad026b63960e3a6d65b4d759b9897242e6ac9", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786427433, "uuid": "553cf50e-e9d8-4f7b-a03a-8e533f733451", "comment": "Malware payload (ConnectWise)", "value": "1372cb3060eb0b37adb7da4d1cdd96765a32bccacbf82ceecc5f9ab66f3d5c4e4c1968f3f92b041cfe3152c23946223a", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786427433, "uuid": "d0363e5f-d04d-4159-bdfe-a1cc280c9223", "value": "T1BF647D11B9C48432C673383107B8E2B28DBDB8301D655B8F57A81D7A9F745D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786427433, "uuid": "7431ed92-0c08-426e-a17b-74e886b46bf3", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786427433, "uuid": "53d22889-9479-425d-928d-d4c4f6b616e7", "value": "6144:imlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:h1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786427433, "uuid": "47246452-51fb-4792-b633-109b383f7c45", "value": 312560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786427433, "uuid": "8519f8fd-91af-4c94-9c78-a469e2d885d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786427433, "uuid": "0a6c4173-8a84-48e0-96b4-3aaea255229d", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b4cca0a-95c7-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786481888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786481888, "uuid": "68f30be2-61c0-435e-a6da-5f80e544442d", "comment": "Malware payload", "value": "f494958bae4523f7b56dc72d0c475196", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786481888, "uuid": "55a71f72-27c0-496d-b99e-c6b284a4de95", "comment": "Malware payload", "value": "0a1b5a7d511f78d0fc5edd2631a3e35db7d78a97ffc500c583e67fbbe66c260c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786481888, "uuid": "c191f511-3955-49c5-a78b-c0199004d90f", "comment": "Malware payload", "value": "4d292dca527647f640f0d7419b077207dae45fac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786481888, "uuid": "7a71f7d5-51ff-41cb-a1ff-9bfef5a552f6", "comment": "Malware payload", "value": "7dac8f1e0dc2b6e2192a29595abadde07bf02d6b8c07e0b182f9234acd00f4068bcc252c782db50626fa7fe03d8251b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786481888, "uuid": "2f28e9c4-06fc-4d63-ab83-a974505741db", "value": "T198A36C47770B2890F82202F163DDA3E03F1551CBAF321EB7586A62F76F735991D06A62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786481888, "uuid": "8e79648a-7c3e-4d7c-a922-b0e0c82ed7d3", "value": "1536:oF+YfOTP13FUCtde0rXxUsEm2NIM34jgL0CUn5p5M/LWi:8OZ3FUCtfHc6ghhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786481888, "uuid": "5487c4b1-6afc-4f9d-a8f3-b70869388673", "value": 99828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786481888, "uuid": "6499bf85-a282-48cb-923c-d4233d223e27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786481888, "uuid": "dd5b1618-2170-4c77-948a-36f1c80f9559", "value": "main.archs38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11845ea1-95a7-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1786468021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786468021, "uuid": "8c3f2205-7cc6-4af0-9db2-a39843c687af", "comment": "Malware payload (SalatStealer)", "value": "95ce332e14255f2d3325caac8b863b52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786468021, "uuid": "146174d2-c460-4f18-9a15-66ab2f370dbc", "comment": "Malware payload (SalatStealer)", "value": "0a4c0116d4ca5cb52138f6437f79cb4171186983e1494e1cbdc9198df17a2e1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786468021, "uuid": "83dae0d9-d8f5-4d21-a4a0-1bf304846153", "comment": "Malware payload (SalatStealer)", "value": "395052e4e1f58e05ce822e0cb4e257bde49a8f02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786468021, "uuid": "09781a8a-8ff0-4259-adcb-55fd8bd7c1fe", "comment": "Malware payload (SalatStealer)", "value": "c026e9dcf7716deb13b01c8757e270e5d0c115a530eaf4b6acd3d76a89992b0584753a2d83d213bbbca8b597da9e5b38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786468021, "uuid": "629dddd9-2fd8-454f-b064-dcc32a7e6993", "value": "T115F5330A462CC3A4FF72AD3E84F11C59632CC4EB37493536529C0AF46B9B74D78AA935", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786468021, "uuid": "479667ba-364a-4150-98d7-a05c300b216e", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786468021, "uuid": "9295dde9-ec54-4a1d-abf8-eb8aaa433202", "value": "49152:kJUnXc0ozEonSTELhokquYz7fAMPRNYhKF7BhWfJsvRXNnr8PKX1GXa+3rKhD:kxWonNVrmNPj9F+fJQr8o1GXa+e5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786468021, "uuid": "291bfde4-f98b-4ebc-9ea6-6afd3706bf36", "value": 3594240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786468021, "uuid": "f9624e12-cc18-4c53-ab12-535b92f7f008", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786468021, "uuid": "816a18bd-390f-4eba-b5ba-4514a05ba03e", "value": "Zapret.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f4fb4eb-956b-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786442462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442462, "uuid": "399779ba-3598-441b-a07e-587b76a28e49", "comment": "Malware payload (RemcosRAT)", "value": "e00946f9f950d0c2330f2a1fa47a35a9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442462, "uuid": "73269db2-c94a-4547-ba3c-53cb61cdde82", "comment": "Malware payload (RemcosRAT)", "value": "0a529376dc6e6e2649c48f420fe8c3668e90400150baa4c3aa1d3d0f7184b960", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442462, "uuid": "2dbca4f5-aec8-4ffc-8778-248127c379e3", "comment": "Malware payload (RemcosRAT)", "value": "76bcaaf0099adfb11fa6f74feba2c7bdbfd3dac3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442462, "uuid": "3122c0b6-3fb2-4c43-a660-9ee34a76fbc6", "comment": "Malware payload (RemcosRAT)", "value": "015ebe98225292b3c1e92b904cc11f0f37892c8719152eab521b8c4a579502f2ed96c59148442e714f32821910262622", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786442462, "uuid": "c6e90168-2223-4cc8-a89f-1f04abd4bbc8", "value": "T16EA5FA3B4A362DA57476505AA4F372941BE1BC41F1FBC49AE469531788C30E2FDB222F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786442462, "uuid": "dee85c9a-a6c2-4181-9ed4-82347bc2b565", "value": "24576:9tQwDScCIB6FU+5QxuTPCrnsbnNZA/7EBW5XM1or2XG6l:s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786442462, "uuid": "01240f8a-81a3-49a3-b517-d9cb524099a8", "value": 2186569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786442462, "uuid": "8fda2a22-b2ea-48c8-ba55-a8b52b19e4c4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786442462, "uuid": "626b4e66-8ef6-476c-a4bd-113367373470", "value": "ZD 0138_1108026_docx.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e806b28-95be-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786478109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786478109, "uuid": "0284cb20-1e56-43ed-81a9-00e6c63e5763", "comment": "Malware payload (RemcosRAT)", "value": "700ccd939712d52d9a72cc169a982896", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786478109, "uuid": "a760bad9-9294-4f1f-a936-26f2169e56ff", "comment": "Malware payload (RemcosRAT)", "value": "0ad552eb950d47106026c8755488f3abd5c34429b4d773739770475f4635a68c", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786478109, "uuid": "3991659a-dae5-41f8-879d-ad65865f9ffe", "comment": "Malware payload (RemcosRAT)", "value": "2265017ffb494dedece6cd1e9e551e1bd4251681", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786478109, "uuid": "aa0635fe-29eb-49e5-9182-c5d8df2d2cab", "comment": "Malware payload (RemcosRAT)", "value": "9a63845ae85365de5d2713c5fddf68fb256fe75832b64f8baca7f313daff0638c66ab0214ad388afd190afab59a43bd3", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786478109, "uuid": "599d2975-16d9-428c-a44d-9033a6840873", "value": "T15B35936A19F3941EED63C4B99F19943E5F2092A60DB3C1897070A4E26CCF785B90DF6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786478109, "uuid": "5bd5b986-fa07-4832-b754-045528a101ff", "value": "192:GGWD3sQ1kfzAE6WjpTp7+S6eTpGNwJzOkZbqxm2OnJyONnLFMbzliMbzb+l7cpD3:GGQIeWRpLph+rxvCx2zT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786478109, "uuid": "582e0d0c-1998-489b-986d-b2343b71f014", "value": 1076886, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786478109, "uuid": "0a6acf55-8a67-4ade-a463-f6a7f450d804", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786478109, "uuid": "4844bab1-7292-49b7-83f2-9df41e0c7fc2", "value": "weneedbesththingswithbetterplacecomingforme.h.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0034a1d0-952b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786414734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786414734, "uuid": "b49b3a79-0acb-4225-9955-995b7d74ca31", "comment": "Malware payload", "value": "158883b02f526ef07e1f29d2ccfdcf34", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786414734, "uuid": "cbd3f668-0f9d-439a-bd9e-44fcbe817d20", "comment": "Malware payload", "value": "0b8e037d160bdb0b621c975c424f680b814bc438fd492ae376ff3140e209e480", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786414734, "uuid": "6f923bfd-46fa-4a93-959d-8062cb91a632", "comment": "Malware payload", "value": "0e539c0e58f9b46c39c6eda39877759ac52b116b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786414734, "uuid": "ec10da58-d640-4378-beba-dcaf213193d8", "comment": "Malware payload", "value": "b4876fe09fc74683a23572bbabddda84f2449b72f439e1ddc4de3830c247585ee51eea737f169c8e650fe2c20471f905", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786414734, "uuid": "6b1ad419-08a3-4fb9-8020-d790a9873287", "value": "T16BE533E1669F9EC3915F9B433234A780FA8540B588ABB7ED21FEB1CFB1358D0114E50A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786414734, "uuid": "e56069f8-0f1e-4cba-9775-47dad477d9fb", "value": "98304:AhHI3nvximhEpaogldcVdBwDoMXgaRtOd5Y8VX:ApI3vxfEbgYVmgwQBVX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786414734, "uuid": "0571f8eb-b3e7-4621-be6f-9d5a8077d332", "value": 3262636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786414734, "uuid": "cf576718-4ace-4a3d-87cf-d7f11a681776", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786414734, "uuid": "4042d360-2395-4084-8e40-597e7e0155c4", "value": "joomla_2026-08-04-fleet-reset_pid38429.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca6974a9-9526-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786412926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786412926, "uuid": "bebd2250-699d-4fd7-aa4f-ad335193c744", "comment": "Malware payload", "value": "9f35cd424ab95e0041cbdf1aed51d0c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786412926, "uuid": "3c3b66ce-5f0b-4f36-8b9a-b87a54f92e41", "comment": "Malware payload", "value": "0c411bf6df62ee8383027f24000510220b4fff2a806a36296bf7cda699540b95", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786412926, "uuid": "1c1db87f-5486-4118-bd7a-f46f2b050936", "comment": "Malware payload", "value": "35e841951a94bf1353725f4f17b432eff555445c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786412926, "uuid": "3b3e2358-45be-45ec-a382-1a657b86101e", "comment": "Malware payload", "value": "17f013ee18e5df04540dbcda8e3bddee9d1f219896c7f86443acbc0f37845f94ce7bb85b0a7e80a6de999aa50c7c83bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786412926, "uuid": "5f737bc6-dbc5-4de3-8c1a-bd465694fef9", "value": "T188368D0AFD55AF66CE2D127288A006D02734FD805F83A71B4B14F63CBEBE6895E917D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786412926, "uuid": "e4004105-f246-4b1e-afdf-5eb69c4ded9f", "value": "24576:U/9csThIZurJXRZ5UPy/FCTuRgjGxRGLIf5sAgrXIrGoalbH7cCNz9V0OCJOpqPU:ocQ7KQ7cIri0JxbUUB+x2U+LoG5E9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786412926, "uuid": "a45e215f-0182-4b55-a1f1-4f9bc7a22f0f", "value": 5308578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786412926, "uuid": "d656381e-1810-4bb3-91a2-958e69fbc346", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786412926, "uuid": "cd49ee01-6f14-4bc6-bed2-31f0511837c8", "value": "0c411bf6df62ee8383027f24000510220b4fff2a806a36296bf7cda699540b95.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ba01df8-9565-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786439744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786439744, "uuid": "a8103da5-9e58-43db-b6a0-a20e7981dd4b", "comment": "Malware payload", "value": "f51c3bc304cf667beed3104c0ada7421", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786439744, "uuid": "4def5a67-cb38-4b4c-a0ca-d4dc68d61d8f", "comment": "Malware payload", "value": "0c4cc485970a7b2a7cf38f30903d7ea025130878b1e7387ba87f9ab87cfa3766", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786439744, "uuid": "78d5e1f8-968e-45a0-a3f5-81d16ea63457", "comment": "Malware payload", "value": "228340369425693d4963317cf8f7d29bcfed88d7", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786439744, "uuid": "efe8c075-7959-4476-a98a-82dd400c7618", "comment": "Malware payload", "value": "d2ce1d0c592ffb4f156d05cb5acdbb26f1fb8904103fcfc026ee7db405c4d9ace92551c614315012fbd724aba7baaf0f", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786439744, "uuid": "8083679d-c3eb-4260-aff7-74cd79a8d0bd", "value": "T14E03D7B2F59A39465061A3E279D0E0D3F94BA7035E0B5E8CB45D41950F2A3E873E8DEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786439744, "uuid": "117fbc9e-daae-4aff-97fe-1fdfd2552382", "value": "384:mPh7Eqdih5Ph7EqdihbZPh7Eqdih5Ph7Eqdihb7A:mPNhmPNh0PNhmPNhL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786439744, "uuid": "d972463e-0c9f-4845-ba43-223a6ccabe38", "value": 39725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786439744, "uuid": "948cd261-28bb-4608-b09f-b49ac479a786", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786439744, "uuid": "15ca4268-bf8d-43e5-82ec-86ffd2d54d00", "value": "Scandoc#767.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ecd9b98-9573-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786445816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445816, "uuid": "3c7b0c96-2532-4936-bb0c-2c94fc46f450", "comment": "Malware payload (Mirai)", "value": "5a79cdd8545ad3dec0beea47703aa5e4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445816, "uuid": "df8707c2-cc08-442e-8886-490869d9e49b", "comment": "Malware payload (Mirai)", "value": "0c961dee0ba45e870a42eaade120941e8b2edb88515ccbad5b019c306db2dd96", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445816, "uuid": "7f01cffb-7d7a-4414-9599-fe9e39dd637f", "comment": "Malware payload (Mirai)", "value": "9c2acb1b4fdd60304e35739be9ce7fbeffed4d5d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445816, "uuid": "32b79ee4-d2f5-436b-9527-0a0317676d19", "comment": "Malware payload (Mirai)", "value": "84c8a4075740359136cb36b01a8a8d1d936a64626e0e8a61a7f95874431c651dc822882f4e60d2f6df6d7b4c5cb2f796", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445816, "uuid": "7d2f3260-eba0-4af0-b56f-c1596bef9a41", "value": "T16B33F286FBB1D384C9ED55F4265AB7069058D01E29C2E03B49D7F1CDBA68F1C1D389CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445816, "uuid": "842e3c4e-89de-4362-9006-d8811c378594", "value": "1536:gSw1SCYrhtZr7vbttHQo2OQFQM2c6tpLTDK+nouy8ry9:Fw1SbzpPzwopQFv76fLTOeoutO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786445816, "uuid": "eebb5bd3-0293-43e3-a87e-cf3137ab612a", "value": 50440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786445816, "uuid": "f887f44a-4d15-411c-87d2-d9cd2ad6952f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445816, "uuid": "7de62a3f-f964-4602-83f5-446e856cdd3b", "value": "sdfjgnjsdf.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c87a03c-9550-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786430861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786430861, "uuid": "0fddf649-0d50-4809-ae8b-a10fd2e5c980", "comment": "Malware payload (Mirai)", "value": "fd8f2b8b96df21edf4106d2fea2f7f37", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786430861, "uuid": "89b5e0d7-9767-4d94-8e84-5f316bc5f588", "comment": "Malware payload (Mirai)", "value": "0ca09c94fac599d2506ab4a10a362dbbc66a089621fe0a5403a124443106f655", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786430861, "uuid": "d4498635-099d-42c8-830a-0a321d6f447b", "comment": "Malware payload (Mirai)", "value": "2b7942ae4834fbb250185126d591ad5ec4554ee8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786430861, "uuid": "09f907b5-af07-4760-b40c-dae9ce05c12e", "comment": "Malware payload (Mirai)", "value": "13a996e041c4ea2ac094d482e7012277613ec03d851a4fa475975f5772464e740aa0575a0856b223f38fcf08bcbc8e34", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786430861, "uuid": "563542c8-d833-4eb7-891c-25de99629c88", "value": "T1FAE36B59FA5BC0F0D6D340F1062BEBAA963799216133F5B1FF5A3671FCB1201298626C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786430861, "uuid": "17133e26-e848-4be2-bd8d-3583310bf650", "value": "3072:DYWVFfQizhixvxOgy2D4nBaz/T5MpWII8P8z:DYqQ6hgvbDC0tMpK02", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786430861, "uuid": "11ccf8dd-9adf-4e21-ae7e-696e1263cc62", "value": 148892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786430861, "uuid": "5f075e04-5d46-4395-ace1-2592c339a43a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786430861, "uuid": "ed374ff4-ba8f-439d-a04e-a2650d9d2d1d", "value": "putita.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c03eec31-9572-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786445550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445550, "uuid": "d3d77e8e-bbdd-4122-97bb-645cc2a25dc0", "comment": "Malware payload (Mirai)", "value": "e0b18c44aca13bbba16e57e308aa61d6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445550, "uuid": "5c06cba9-54df-41a1-9300-adec435073fd", "comment": "Malware payload (Mirai)", "value": "0cce7e68e0b7c086bb358f7b158a406f6f89a7875d4fc0a603f30c42cb00ea91", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445550, "uuid": "0d7d58a8-13c9-4d53-948d-4986e2b8a0ba", "comment": "Malware payload (Mirai)", "value": "59128c14427ed45d9d7c454c229504cfef31abd3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445550, "uuid": "c3a331f7-6a66-4651-9fa2-43cb4427afed", "comment": "Malware payload (Mirai)", "value": "cdfb7a0821e82939231b1d852c1f9f97a02e2eeda9cb0795d18a7c599ac3f82aaa284fc3a4490817c03e36a3cef0c033", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445550, "uuid": "28d56dc6-0ee7-4b5a-98b3-6086eb15000f", "value": "T156516FC8119268717CF69C2772698854F8C47582EDCA6F05E8DCB4F998CCF0AB515BB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445550, "uuid": "9e1acffe-1ed7-49e4-a7a2-7335367088f8", "value": "48:2RKhEcfEnsTE1hxzTfTT9zsTYz1T/zHTlzKTCzT3Tpz0TgzwTkzlTvzcTC:2RKhEcfEnsTE1DXf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786445550, "uuid": "2f281335-3b93-4d0b-a391-e8c468a13437", "value": 3037, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786445550, "uuid": "93ca0c10-0fc5-4280-b5b9-195cae08cc36", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445550, "uuid": "9385a400-569c-4fc6-9206-e260e457abe0", "value": "kla.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "603d454a-9573-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786445819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445819, "uuid": "1a24c5e8-b14e-4db5-9597-d54014fc0b80", "comment": "Malware payload (Mirai)", "value": "bdee6f376eaebb6a4c0d4ed9c1ba670f", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445819, "uuid": "dd959d39-99df-447a-a708-cddcc49d993f", "comment": "Malware payload (Mirai)", "value": "0d074e64dca31018f90cec621577ffcf31a63a1c749a678f3990dc24176f7c06", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445819, "uuid": "f7ec4dfd-33be-4563-a69c-7e43aca96d55", "comment": "Malware payload (Mirai)", "value": "6149d2e282faa637abb4d40ffee64b257e1dc98d", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445819, "uuid": "41c4797d-e21b-4b1a-84a3-6dd7a5c86d37", "comment": "Malware payload (Mirai)", "value": "a03fdb535f1ed5f39e7288320d259c4516b6d265d5f413db8138b733cfba0aa4937d7d7001d4980356907c840078d826", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445819, "uuid": "7aa91426-4736-46d0-bf27-ed26e19ff3e9", "value": "T13B53028352027DA2D3B251F7EE7149818D630EFD44E8763D4A28CEE9D20581B6CF95E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445819, "uuid": "974b2baf-8cf0-4ad4-a8c1-46e9fff12613", "value": "1536:TyCSFWBozQxlOqA957T7tZP8xNFp8GcQ6bh3QR6+E5zI:TyCBozWAP7TBZcFavQOD8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786445819, "uuid": "2d0462c7-a11f-4983-aa4e-b055cc8dd4db", "value": 65188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786445819, "uuid": "78e1d881-3e06-451a-9278-146d92ab6a23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445819, "uuid": "a0769655-04bd-4ee4-b4c9-ebc8f6eb25ae", "value": "sdfjgnjsdf.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0a35f98-9561-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1786438250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438250, "uuid": "57603e84-eccb-407f-8642-48648e097937", "comment": "Malware payload (XWorm)", "value": "1240b52f43089fcb0c5de3f95d52d04c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438250, "uuid": "d6d084cd-a325-43b4-925a-fb74d662baf2", "comment": "Malware payload (XWorm)", "value": "0da02f091c865f8c8577f9e6baa82dd9126ade41c7eef3968571fad1971a8ae1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438250, "uuid": "0abfcd30-4e0a-41ac-beb0-250c89da21a3", "comment": "Malware payload (XWorm)", "value": "bad58e1bea081c16470519419ffc6cb901551279", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438250, "uuid": "930a4b9f-2e7a-466d-ae34-8774b6057cea", "comment": "Malware payload (XWorm)", "value": "dd1132cf6091fd889ef9e87dc9aed260c0fbd466163e76c75dfdae8abb3c522f35e7f25ffd04a6e98c804c3fbc839d7c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438250, "uuid": "826d78ae-c266-4865-8d4f-bc610d88579c", "value": "T1CE25A4D7D7E20084F69E0FA6C8B7E05397DA040E57632A9D75DEA9D0319782C8336EB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438250, "uuid": "df614e45-daf1-4ada-b75e-e2c98aef5857", "value": "6144:n/Td6rtMrJZlr1gtr0urjrrrAvvHhhxOdw3ELdyJMunrgyTwChZgEIu/H5rpLdm/:4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786438250, "uuid": "1d3dcca0-eaa4-46ef-bfae-6d10071816c9", "value": 1019664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786438250, "uuid": "eea347d0-fee3-47bb-9f85-c7c7a8a39a5c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438250, "uuid": "4c5496a3-9390-463b-ac5d-6b81ed99d330", "value": "PURCHASE-01.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a05db802-9534-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786418868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786418868, "uuid": "7897c8ab-898f-4844-aa36-67c02dd67fc2", "comment": "Malware payload (Mirai)", "value": "1680ce7f708532ae6f773fcea61998ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786418868, "uuid": "d8a17a7d-bf43-4e67-ad43-d5cc302456ba", "comment": "Malware payload (Mirai)", "value": "0da63dab54b639ba5a5473946042437937eed15cc834c37d2544d5793be1cb73", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786418868, "uuid": "736cfdb7-a845-4e11-ade2-eb37a0808812", "comment": "Malware payload (Mirai)", "value": "408be69be8d7f8c6133e14405921122b77385c55", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786418868, "uuid": "db92b155-bc14-43a5-a192-9ff96460e2ac", "comment": "Malware payload (Mirai)", "value": "6dbd59459f4d548f529f9a7c57b27dc697e1dce0db236dbe050838f0ae98b10fdd93dd2f2a81bb9c8a737fb40c3c7877", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786418868, "uuid": "4af59eb8-dc1f-4e5b-b083-8df69369ec80", "value": "T137C33C99FC90DE52C6D52575FA5E428C332353B8D3DA7206CE209F34B7E785A0E3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786418868, "uuid": "de9a15fa-3b77-45fd-b747-00febff30bd5", "value": "3072:BXUxfT8OKZofciiuEJxUQ4g8O5CFk9pfbLqsybt7sejG5hf1Dl:B4f/LEJxUQ4g8OEFk9pxybtxj8h95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786418868, "uuid": "66d69d8c-6271-4352-ad9d-8d0c405b18b4", "value": 124372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786418868, "uuid": "319c1fc1-478c-4a4c-b3b5-e250ea909e5a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786418868, "uuid": "f0cb8c58-5280-4b28-a42a-1a497d3dffd6", "value": "putita.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fd25e01-95d4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786487533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786487533, "uuid": "a6636a79-31f9-44a2-ad2a-768571a1bc21", "comment": "Malware payload (Vidar)", "value": "ec46450cd306fdd2576a517eeb5f1d5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786487533, "uuid": "b42b3177-dda8-4faa-b158-155b8038ab4d", "comment": "Malware payload (Vidar)", "value": "0dee9841ed7ea5c9f9b3bad8fdd97592edc010829956f5395418996589579b09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786487533, "uuid": "23e402c3-f384-4c37-b26f-fda4eb1fd72a", "comment": "Malware payload (Vidar)", "value": "1f973611df66212680074c0fd417537638b76baf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786487533, "uuid": "793fee23-3e72-4b66-b3f4-a323dbf14918", "comment": "Malware payload (Vidar)", "value": "961a25baf03daae58617ffbcd863aff5395efc7e71cc15a5359613227051842493e59960e7dc3dd747efa2e91a06b427", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786487533, "uuid": "66cfe4ec-94a1-4cf3-a497-fc178d9d9811", "value": "T181766B03AF605AB0D445E739843B4242B9B4B8AC8734B3A32D61BC787F663D19D79B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786487533, "uuid": "0811ffb8-1263-4257-826d-eccc18c6b3e2", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786487533, "uuid": "b2f7cc06-7210-40d0-bcf4-849ab440f733", "value": "49152:ufOeOdR9oEzcIEJQI+K209XDI3FVkHWkle0rmWhpvUPokDqrhFdFD5+Zh44FY:uTO2rnI1SWCpUPfMlF9UxFY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786487533, "uuid": "ea5fc03a-f1fc-49c0-81fc-ce40330702ff", "value": 7489352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786487533, "uuid": "b2168fe7-8d63-47e3-b7a8-2c86f3cf838d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786487533, "uuid": "5b77a8b9-acb3-4f85-9a90-52c253c3e9ed", "value": "0dee9841ed7ea5c9f9b3bad8fdd97592edc010829956f5395418996589579b09.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "378111c0-9551-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1786431148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786431148, "uuid": "23b2fc75-fee8-4cab-877b-02c234142102", "comment": "Malware payload (Efimer)", "value": "79a3c9f9e153e867f36e1b92dc7af8f9", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786431148, "uuid": "d846778e-0bd5-46a0-b85c-afca8b2ced68", "comment": "Malware payload (Efimer)", "value": "0e065c8bc59e1bdc8063b6c7018241048e008214bb7e780549925324205f977f", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786431148, "uuid": "c14479f4-8b4e-4bd8-8ebf-b41162f80a30", "comment": "Malware payload (Efimer)", "value": "5c1e890da1ec124afb2a524eb8e1e265669e927a", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786431148, "uuid": "f81b8443-1d55-4cbb-ab64-cb4db16c0591", "comment": "Malware payload (Efimer)", "value": "0a7f77bd235e8a5b6d4696dda5ebf8b92ccaa2c17e494f10482051c9a05d6382d581a7436744f64d9a8dbb706017951f", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786431148, "uuid": "7d1c266a-da98-436e-8add-872348921784", "value": "T125E6334CA6D011EEEEB3917CCEA12585DB2974620332D69F03AC47656F132E4AE3CE57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786431148, "uuid": "48a4976d-48bc-4bc5-bf2b-af60fc20454d", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786431148, "uuid": "7a6e57de-25c9-4e4d-b3c0-471cce56cf81", "value": "393216:ZMmB5NrNYlrSPkdd5JXMCHWUjiZcuI3/PGTAI:ZTnNq4PwdbXMb8iuH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786431148, "uuid": "861c0ca0-854b-4778-8d86-de9d78160ee9", "value": 14051797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786431148, "uuid": "15004a50-6bd0-468c-aa22-ae9a764a9ece", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786431148, "uuid": "42ac444a-16b4-42f5-a5f5-78f9f36b4b75", "value": "composer.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61e944c7-9525-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786412321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786412321, "uuid": "f8e8f1c9-d64c-48b9-b4f5-4b49fbed9e7b", "comment": "Malware payload", "value": "d6f678b0d5656c4292a78a5deee33bbd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786412321, "uuid": "bd44442c-0e8b-40e7-8117-ede667ac49d7", "comment": "Malware payload", "value": "0e3a78094c70edeaa6c07fcc4c874f4d1a42ff8e9f1a3870e9fad4ead8ecc46a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786412321, "uuid": "ca95a7a4-410d-4619-8813-f90372077716", "comment": "Malware payload", "value": "14a0feafb4b64043cbaa0f2d7b7408a4e0eed9f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786412321, "uuid": "4613fd72-c555-45db-9471-c33d0e9dcaf3", "comment": "Malware payload", "value": "83ead39ee615b97ad5f796845dc124f6679871a60c9b9bc54d573e601a7763e553cbb2f0b181f31cab25cb5be116bba7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786412321, "uuid": "b233a857-856e-4953-8418-1404da30e240", "value": "T15D661956AE832BA6C99C033445FE629752603E454BA1433713E4FBA83E7773C9F56C88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786412321, "uuid": "6dcd46cd-467a-44ac-9c2e-55259d9d9845", "value": "24576:cff4wJxB1RCUOQixHF2WsvSy26yD/M+ibGEpbzZUYQmnwecN2ofMC6Lm/ahsUYq8:cffNJxB3zOdTK24qkUVmwT2Pi/F5EY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786412321, "uuid": "324d1e23-1464-431b-b179-d489eedb0792", "value": 6488226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786412321, "uuid": "ac86c710-4f0f-480c-a235-1b46315783ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786412321, "uuid": "2306dc86-7608-43de-8d79-89e35fb3670c", "value": "0e3a78094c70edeaa6c07fcc4c874f4d1a42ff8e9f1a3870e9fad4ead8ecc46a.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71eaa9b1-9589-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786455297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786455297, "uuid": "b0897e5d-6b5b-4b9e-86d9-fc7943df27b8", "comment": "Malware payload (Mirai)", "value": "0f3ff049638f19c178cc732d5dd43bfd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786455297, "uuid": "f59144d7-0101-4362-81a0-855654d047c3", "comment": "Malware payload (Mirai)", "value": "0e66fca2cc47e586e9e355526cd72369878a6e2ade9b979609f3796aa7e4c653", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786455297, "uuid": "9a6d8dce-2e01-43dd-b0f0-635430f8fbea", "comment": "Malware payload (Mirai)", "value": "4b30e778caf0015981e0f9f063c8f2904af63d20", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786455297, "uuid": "996daf3e-d276-41fb-8dbb-18d5920e81b7", "comment": "Malware payload (Mirai)", "value": "0de1207400add52ccf797883bfa4d150d567501f6ff1b9287b3869aba69365a4a5bf39e4ab2b7d793cc7e448804731ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786455297, "uuid": "356ea27f-ed92-4c30-b86c-24371cbe0788", "value": "T184731A91BD82566EC2D063BBFA5E528D333563F8D2DE3223D9118B1133CA51F0977AA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786455297, "uuid": "99d15fb0-3d32-4797-82dd-3a2a84d6fcd8", "value": "1536:wnhLIijDyU8qNxcl6TCMXYoEp4ReABaPkR2mWfgQIyduN3:6pIiHEqNxcl6TJ6pALGoelq3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786455297, "uuid": "5c7e8025-0b36-4c82-b1b4-f36f384d261f", "value": 80544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786455297, "uuid": "9220640b-ab39-4368-9cc4-0c0959b9cdcb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786455297, "uuid": "054f7ee4-6fc3-4660-a9bb-965fa37ee36d", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a534d38d-9579-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786448512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448512, "uuid": "10fb3268-a95d-429d-826f-a4e75682edbf", "comment": "Malware payload (Vidar)", "value": "d7b1171d32d089bef61e4220b3fea120", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448512, "uuid": "a9b6f5f5-6c16-4e3f-806d-f568cae9e13c", "comment": "Malware payload (Vidar)", "value": "0e889de168753a48179e291d6db719e0c1de1a48cffd53800f2afa2b85e845c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448512, "uuid": "7c653473-bc97-4ee2-ac2e-042cc160de0b", "comment": "Malware payload (Vidar)", "value": "eeb7fd7228f795b2644df59a7ee7f292a9532636", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448512, "uuid": "4299f659-610d-4e78-b6d9-4f9658c2f88e", "comment": "Malware payload (Vidar)", "value": "10aff859e7019dce780e76323045b123c8474596ee82f368ba35a212e606aa64c08b73859f395e050451930b7f56164c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448512, "uuid": "813da78d-db90-4b33-b58b-f2341f5c646c", "value": "T195167D42F8D109ADD499723189F362627B3CB8881B3323D72EB176752E72BE05D36758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448512, "uuid": "89ddbad6-6a1c-4a06-9649-5537ee204add", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448512, "uuid": "3eb78687-5d65-412f-be17-1700810ba48e", "value": "49152:KqO+eTRtSOTA5CH56HfLYm2NcKq7UEox1uDnFZ89WUlkN7zAec:KM+0VuHx1uDnFZ84UinAec", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786448512, "uuid": "867f25f9-036b-4b38-8c18-9252baf411c8", "value": 4369464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786448512, "uuid": "f5a7de4b-f5a9-4349-af17-9d3759e73f62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448512, "uuid": "b4f6c3c9-7915-4c7a-9ac3-482a119bff20", "value": "0e889de168753a48179e291d6db719e0c1de1a48cffd53800f2afa2b85e845c4.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c8b6211-959e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Ladvix)", "timestamp": 1786464227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786464227, "uuid": "d1a5362c-d25f-443f-b074-611f6d4ce03d", "comment": "Malware payload (Ladvix)", "value": "2a6cf2356d0a688188fa36498bab851d", "object_relation": "md5", "Tag": [ { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786464227, "uuid": "f2ed8cea-cbda-49bc-8fb3-fe338971a4f5", "comment": "Malware payload (Ladvix)", "value": "0e8bb85c6e8976111a9b33fd0f47b18d01d2755f3a34d365b991577e45b2f14a", "object_relation": "sha256", "Tag": [ { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786464227, "uuid": "3cfab65a-0309-4851-88b9-403288a8a4f8", "comment": "Malware payload (Ladvix)", "value": "954f8e31e0d7eba95c72150d440efd0bcb26d179", "object_relation": "sha1", "Tag": [ { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786464227, "uuid": "5605b746-10ed-4edd-975a-594e48c2d658", "comment": "Malware payload (Ladvix)", "value": "463dbe01b0e7f548f9941cd5db74fd8f94ed705e060216c25792f33be3502771aaad65125364555c9b21353e9899f67e", "object_relation": "sha3-384", "Tag": [ { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786464227, "uuid": "a3ba6f75-3194-4fc2-9004-585678e43916", "value": "T1E4B57C077CE119AAC0AA93328DB651A2BBB1FC490B7123D72E50B3782F727D45E35794", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786464227, "uuid": "a7abb24b-17ba-4c8c-ad37-7b3437f39897", "value": "49152:6Av+UKkhbC5+b30qnW9ZlUIyoVWPR+tWTl3Ad7M+y:527ViRX3AZMP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786464227, "uuid": "64e0b359-05b4-4be9-9210-a45ea615e035", "value": 2399920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786464227, "uuid": "af742dca-6651-4803-9994-75f2f974d4d9", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786464227, "uuid": "2c1c68a0-c18a-4238-9c14-bf63d28bfe56", "value": "oldboss", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12a4ec7d-958e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786457285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457285, "uuid": "a47f6ee5-30d2-416a-9fa3-1f9bef24be45", "comment": "Malware payload", "value": "3d5913b2c68f637be4c2ab1106e7103b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457285, "uuid": "205df15e-b6e4-4b77-87c1-a80c147dfc85", "comment": "Malware payload", "value": "0ef8d93cb6a5b70d6a76b2afba13030da67a61773771b0ffbec73d800624eadd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457285, "uuid": "14ccf7dc-cbf8-4974-b3a6-a1998e5f2ffe", "comment": "Malware payload", "value": "cdb917fa3854cebd969a376d8a9ff4633326b4a0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457285, "uuid": "fa846ea3-369c-4a8c-af18-4825e3652296", "comment": "Malware payload", "value": "51f323ff0285971c55e40e7bc85e45e8a5987b0a514b9dc4a4dc58b0c6aeb40dbbc78f0714349e0898c02874bb20a36c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457285, "uuid": "3dbf4fe7-a152-4789-8f5f-c7e847716f56", "value": "T1CC51379B01184B31960EC65EB7F4B274620AA3D2B6DBC604EA888E5F4EC5D5D36C5E50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457285, "uuid": "63bb1ef5-095d-4ee3-b483-4d5f41dd91f8", "value": "48:Jc31l12JMXChCbiBzuquuZbBbBcvyhofbqbbw2vnhnUXmDwlwhM3Xyl:uP2JMSQbiBCHuZyabwY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786457285, "uuid": "75ccd390-c556-4691-8a7e-329157ae1d40", "value": 2829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786457285, "uuid": "4c887e36-c8fb-414c-91a7-dd8956833a39", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457285, "uuid": "8cc7e886-d5c0-4a3c-9dc8-2ff85e5f25dd", "value": "run.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "391fbcc2-958e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786457350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457350, "uuid": "ca57adb9-f11a-4faa-8c2e-994decc391bc", "comment": "Malware payload (Mirai)", "value": "11dc62002a06e2e169c00fd74e3f87ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457350, "uuid": "03c3b2c5-ed86-491f-a889-8d7c2e29c9c3", "comment": "Malware payload (Mirai)", "value": "0f22655fe8e2d7440449c825caed04a6f5fba86762c26c989cd1ee1cfa50b53e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457350, "uuid": "5e606662-242d-47d3-8591-94459978ca2d", "comment": "Malware payload (Mirai)", "value": "030c5d6885a6415bd8364af5c6197ae129737eb3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457350, "uuid": "3c0de5ca-e0ff-476d-a7f2-115ebf9a17d3", "comment": "Malware payload (Mirai)", "value": "2cf48b9ac4449a439a2359252202856a133f19924ed047c4be577fa67d10d6939edf7c6707ea6f73dcb830a28021da81", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457350, "uuid": "9557263d-aa26-42a4-ba98-b0bf9322e788", "value": "T1E0D1A6577F458F27C8C261B2F79A8324BE19AE06E6EB7347E312BFD037051D20A29519", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457350, "uuid": "d741712a-09e1-479f-ae2f-564c82b9fe28", "value": "96:O/Xh/3wOVU0HKfR2m4x/3A2XX33GNWx737vV4gvb+14mwhZx4ekFIR8RTmifJq4:O/RoOrHjZw8XnGMxfvVkEZx4eneT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786457350, "uuid": "ece48cd3-75a2-498f-904e-b4bcf4c6b659", "value": 6616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786457350, "uuid": "5c40d71d-125e-4aec-8862-d71868a7862c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457350, "uuid": "411faabe-c7da-4b95-8dc7-196f4cf4536b", "value": "dlr.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce3eac4b-954e-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786430112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786430112, "uuid": "fa7223d7-45db-4409-873f-a97d39cb572f", "comment": "Malware payload (AgentTesla)", "value": "0c1ebde4954b17c408a323f4900c728b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786430112, "uuid": "276dd71d-b5d5-4a50-bf1c-d1c2ff423eea", "comment": "Malware payload (AgentTesla)", "value": "0f51c133d05ca40f9c57cf13daa3c946c4f58716493f2e0bbb009c31f275d75a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786430112, "uuid": "b2009cd6-49db-43ad-806c-93d99946a8b4", "comment": "Malware payload (AgentTesla)", "value": "b2fc2b78c0e90a8ab56a7207097c9831bf110eb7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786430112, "uuid": "33a95e11-f2bf-45cb-b0b2-3595cfae2719", "comment": "Malware payload (AgentTesla)", "value": "409f5d95e1179e87f9b656485b7539e8789c4443dc6d7eef632d078ea1e9d84fe114dab670dd511737fcb1f56ea675b1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786430112, "uuid": "96d26119-79e7-403b-9b43-983fdf888e8c", "value": "T1DA356426454D916888A05D03EC3AF9558D5CC23ED436AC3B373629A656D4CEF0E8BFBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786430112, "uuid": "cf008875-d538-4725-9cc0-187626ff9cf2", "value": "192:WpnajTHVpFOiyJyJMuzoEpKcCwWYfPXROZGROZgwLQPer0986/7Q:WI7MKzfAcPTe6/7Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786430112, "uuid": "9796aef6-7f1a-4e33-9f17-d344ec802467", "value": 1082606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786430112, "uuid": "2cbfa9eb-34f6-4a1d-8f18-61aee42b2b61", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786430112, "uuid": "66003d20-bfd9-4d3c-b916-c2d62b1d5a2e", "value": "orden de compra.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdcefb6a-954a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786428474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786428474, "uuid": "7154f3a5-e23e-42db-94bd-f1831eb85e37", "comment": "Malware payload (Mirai)", "value": "a32fd9ff4924381a5cd3972bc148de03", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786428474, "uuid": "6f004423-16b1-45c4-b627-8eb40054f188", "comment": "Malware payload (Mirai)", "value": "0f68e1542e291b0ac32dc954e922a718a09f8c17e07ba846f2d00e267b8ef4ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786428474, "uuid": "fb42f3e5-9b0f-4d4f-b459-7ee406082eac", "comment": "Malware payload (Mirai)", "value": "be9dea31a02360f88bf7964fb6284b15728636f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786428474, "uuid": "094cea93-79c0-4274-874a-ca3349aa77ca", "comment": "Malware payload (Mirai)", "value": "f30b8c36ac4e46635207c0fee06ca6268b5770585526be0d36be51b715d29399219aee09592a1209b8cb11e99caa244d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786428474, "uuid": "fafee11c-12c3-4178-9075-e4afa1440fc2", "value": "T1E7A3E71AAF611EB7DC1BCD3705AC1A0278CCA60772583B757578D82CFA4A54B8AD3CB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786428474, "uuid": "83b1473a-56d8-4d29-9396-ea53aa424eb5", "value": "1536:ZRZUYnbsjLeis8Ioo70Yp3Wm/YeZ89QURraRGpHV6g9HKOcPX9/:jZ90s8a73R/GHm/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786428474, "uuid": "bdde9670-6fdc-450b-87a6-948e3a87395f", "value": 103824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786428474, "uuid": "bef21b96-6d24-47c1-a7f5-f3afbba576e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786428474, "uuid": "b61dc850-653c-4d56-ac18-3d539682e50c", "value": "4YN", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fcd5081-9569-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786441443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441443, "uuid": "855860d1-29af-43b8-b43e-81f5b9087efa", "comment": "Malware payload (Mirai)", "value": "a3e235eb3eaea22ef2331cb01af67e46", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441443, "uuid": "4aac4501-34c9-4373-aa6b-047624ee05fa", "comment": "Malware payload (Mirai)", "value": "0f93538a340eff2eb2de53e1f27f91656c0864e9d7ab7a03c0aa0bbf4d3f4b51", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441443, "uuid": "8bb5ab02-7831-4b95-932c-b83b8b6ac03b", "comment": "Malware payload (Mirai)", "value": "7ba73ef805b7657b308f13d77b0b55a410c5dcfd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441443, "uuid": "a892174d-fc2a-4861-b8ff-dd34e60363c4", "comment": "Malware payload (Mirai)", "value": "298ada300af33893fc34b1a13d9e3fd92b24ade825945350944ab3a9b505616492839ee97b84c72d9db3e2a885791af2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441443, "uuid": "9df3ba39-80bf-4ae4-9c08-715f9beb1f1e", "value": "T1CC448C45BBCDEEC7C0A487FA9D4F4B636323B861338792633815211EE98E3D84C6659D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441443, "uuid": "a6f8f50e-c858-49ac-8145-11a8de56a28a", "value": "6144:Gqp3FIZ+lv40GBK66FQWIqLohjE0TvGo/k:FyuI+QWICoh9Go/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786441443, "uuid": "bb33c3b6-d288-4094-8f2c-855945068f86", "value": 264296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786441443, "uuid": "b1fa0568-d6c7-43c2-a773-e9c1b9d0b3f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441443, "uuid": "f69290d1-7ffb-4690-9dac-b6f331464ee3", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfc0cef6-958e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786457629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457629, "uuid": "fd9190fe-7de5-4b07-961e-9e35b23b0500", "comment": "Malware payload (Mirai)", "value": "4cce2c61c187f13f7cef941554f4884e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457629, "uuid": "20f241a8-33d0-4ae7-9bc0-a426ec5a245d", "comment": "Malware payload (Mirai)", "value": "0f9f3634949e0632da172e33c8a63172cfe4feba72f38020d6a1b7bffda21ae0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457629, "uuid": "7140c4ea-9aa2-4b1d-8bbe-372063cabf58", "comment": "Malware payload (Mirai)", "value": "2e50aae886db6f3bd3df10d01b4a8c586c8ec605", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457629, "uuid": "4af25e9f-4cd6-4d5e-8163-b779b14b77ee", "comment": "Malware payload (Mirai)", "value": "991bc2837a518f2c6aa151b539a7e46174a879aef15a07c05096a8210bda153aebbdeb444d94eb4d367e1cbf78ec27bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457629, "uuid": "46241738-90ab-4f3b-873d-81b71c54ac88", "value": "T1A904971E6F228F7EF668873047B74D25A76823DA27E1D644E1ACC1105E6039E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457629, "uuid": "5f2a69d9-2cef-45a2-b219-3a90ce1f3a9c", "value": "3072:WuIugL3KfzVLjCtjWdu2eWBY+192huuHLMrN:JrY3KfzVLW6dPc+WhpHLyN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786457629, "uuid": "bdd6fc97-96cc-44d1-84d7-86f783deb576", "value": 173860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786457629, "uuid": "9ff2595e-040d-4aa8-bca0-08bae4c10b69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457629, "uuid": "03895721-8b4c-4227-b727-105366b8a3d3", "value": "bot.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d08c027-95bc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786477059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477059, "uuid": "69106f29-5c84-4967-be1d-4d1c698f8117", "comment": "Malware payload", "value": "e7fefa4fb1638159e8fdc3d96d766909", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477059, "uuid": "bbbec6c2-c78e-445b-926b-f317c217ee56", "comment": "Malware payload", "value": "0fa3360a6a00ec8d3c988f4f81be8e79674bb8cf58c9350237062eb60f54bf4a", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477059, "uuid": "c9a9a9b9-5ce9-423a-916d-55f97735431c", "comment": "Malware payload", "value": "b5ee0505e6d5dd47fb5b1e5ce1e67268208a1273", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477059, "uuid": "f26024c4-8849-4c26-b1d3-ac9a019dc3cd", "comment": "Malware payload", "value": "6660aa5369b327e3e0cf01ad60fd98485a347d23d70e0f01797737a5b13a00ed257aa7797b4aa6ea80814b4c01934e45", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786477059, "uuid": "7526103c-3a1a-43b2-a3cb-9d3ac4f991e4", "value": "T11727339BF706559AC9F6573748726A7125478CA2CF87C7C36810733CA87B5E40F8AA8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786477059, "uuid": "25951eca-cd64-406d-ba5c-ad790f31d1cb", "value": "393216:I8LfifaTzVI9XUSoDqQxgXWff/RA/XMxTy/R0fExFH:I8TTz+iSiNcWn/RuXMxTyCfop", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786477059, "uuid": "2bb2583d-5ef5-4108-8cdd-75a8bbb09572", "value": 21784009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786477059, "uuid": "66b09234-19e9-49a1-8382-dad0f92017ea", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786477059, "uuid": "c509f183-70b8-4c2f-bde5-62dde2c40cca", "value": "PornTok.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6756f6b-95bc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786477397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477397, "uuid": "14de24cc-0ab4-4ba6-ab20-321d9ef632c9", "comment": "Malware payload", "value": "d739a572fa44fda46446eb1e07cf0f09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477397, "uuid": "02d8f904-e2ec-4c4f-b72f-cb64a6e936a8", "comment": "Malware payload", "value": "0ff6c17d8a9cda9ec761a456b20a086cf5d8c5595eeebda2e70ae32ae2e1f724", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477397, "uuid": "e819a7ff-ac86-4ef2-99bf-31d21c91ba0c", "comment": "Malware payload", "value": "8a37816e968e3a46eb17a96f73207afa12561dd2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477397, "uuid": "55c4607a-d2f1-47e9-aaa1-cdadb4a9b03b", "comment": "Malware payload", "value": "aae7bdedb2e8192097d5e2c5c9ee5374412eb1a4c3f29791c448726cafa6ff5c06852e3a36ed50149a4a1c4d704a9276", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786477397, "uuid": "1398e7be-db2c-45c9-801d-8a35c5cae1d2", "value": "T17B366B03EEA548F9D296D73588774242B764BC499B3533D32E60BA742F363D0AE79B40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786477397, "uuid": "4f2452c1-abfd-480d-8e4e-53660c7fe6d9", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786477397, "uuid": "542476de-09f7-4d12-9b1e-e29ee04bcab9", "value": "49152:uFKpz7i7FAlc03DCBGcm+a1h6TczyJPj4RRHrYvAaaw:uc3XND1aJrCOkw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786477397, "uuid": "b229c1b1-4132-423b-b56c-a4670114eb19", "value": 5002783, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786477397, "uuid": "b9618669-5dba-4feb-bc8e-82c8be44f033", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786477397, "uuid": "3f7d88e1-7007-4a11-82fd-750da6336c88", "value": "0ff6c17d8a9cda9ec761a456b20a086cf5d8c5595eeebda2e70ae32ae2e1f724.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7f76509-95bc-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786477373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477373, "uuid": "e4fd7292-9d5b-4132-8232-2ed2293442de", "comment": "Malware payload (Vidar)", "value": "c209788a26fbc41bf7258be7fb981394", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477373, "uuid": "9fd65962-0336-40cd-b31d-fc32b99364e0", "comment": "Malware payload (Vidar)", "value": "100c72efcc4ff70d7a3352efb45845f7adb7d342115e57024f87b67883abb2e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477373, "uuid": "d4671d35-42ca-4d4a-9aed-75f47e2beadd", "comment": "Malware payload (Vidar)", "value": "f18183776c17632ec3bbe192d36a8966da641210", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477373, "uuid": "f02f8c68-9cfb-4a08-bde4-3338bfa2106a", "comment": "Malware payload (Vidar)", "value": "0d06caedec3a5532574d7b92428bf8732d243d8440dc508c666ff0555f5331885cfe95f463bb6ccc2d4b91f5c2e6be27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786477373, "uuid": "005d0f9c-62ea-4d87-a33a-9cc026751e7e", "value": "T1A4269E0BBDA25875C09E93368D7202417768BC5B4B3633E72E60A6353F73BD28974B94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786477373, "uuid": "d076e138-7079-4436-95e2-6dd29e6553a4", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786477373, "uuid": "dfbacdf5-5897-4dec-8e53-ab8d0b2c29e8", "value": "98304:K4uFdOI6QZUqHXRJTCBOkgoQNzcEOlS1z:K4Kh6QZUqHBJTGVgo4AEx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786477373, "uuid": "a5c81b82-4ff7-442d-b1ea-794e1f754fbf", "value": 4585728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786477373, "uuid": "512955b8-9442-420b-9396-3f0cafc69675", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786477373, "uuid": "8d36645f-745b-4125-b05f-46e8012c61b1", "value": "100c72efcc4ff70d7a3352efb45845f7adb7d342115e57024f87b67883abb2e1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "354fa43e-95b1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786472376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786472376, "uuid": "44e1f1b6-83e3-4ce9-a644-8ba2e66509e9", "comment": "Malware payload", "value": "b0c42276014342498bf5652e23584d97", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786472376, "uuid": "d5c1c5c9-446f-49be-a165-b9903ff1b648", "comment": "Malware payload", "value": "109e7e69eb96d600c3e3798f59af8a0f57f5f8f1dad2dd789360294fe7c2c2c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786472376, "uuid": "3f11e66d-d898-48e1-a8fa-e612d7089a9e", "comment": "Malware payload", "value": "e78300016779aad78122bb20060fd1d8844478dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786472376, "uuid": "8970a6f2-9cc1-4a4e-986e-76e0400861e4", "comment": "Malware payload", "value": "10fbc3807f7125a50873a5ffb35a04035490611e25da50cc283fa6fad6a515c389011bef4355d96b3486b437b43dc530", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786472376, "uuid": "9e55b31a-e891-4ce5-af95-a30be9f65e7b", "value": "T1D6D30A56FF0C4417C48369781E3B07ADF320BE1150B99526330A6B6F3BB6E316687B99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786472376, "uuid": "925da354-5edf-42ca-97ee-e2a7daf7242c", "value": "1536:OTkXi23cGzBMlrbq/5e1hbgtQX8zcRH29aiAI3e+ANpJ/nbmq8rGj:OwS23c8Mlbq/5Y8trcRH29A7h/TUGj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786472376, "uuid": "8ab4e42d-a29b-4184-a53e-df42d91ca780", "value": 132064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786472376, "uuid": "a30afd49-2c5c-4bc3-85b6-cce771c70eb5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786472376, "uuid": "fdf3c999-6c68-4654-a45c-594bee1985ae", "value": "109e7e69eb96d600c3e3798f59af8a0f57f5f8f1dad2dd789360294fe7c2c2c2.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e9b4114-958c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1786456473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456473, "uuid": "03aed974-6490-4255-8e55-b88e3d39e544", "comment": "Malware payload (Stealc)", "value": "1bc05f08cb54a809b1cd9d7e0c3d6f2b", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456473, "uuid": "7fc52cb2-dbad-4cb2-9544-ca430f3a7752", "comment": "Malware payload (Stealc)", "value": "10ecf5b905fb157b49a4e0a7ee2a429fa4f14ba1f5aa83ccfb2fd435826eb371", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456473, "uuid": "20137bff-ce01-4ec2-8782-c29958a951bd", "comment": "Malware payload (Stealc)", "value": "48a682b4a52b8c801548ff5ff9b34917e8569ec8", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456473, "uuid": "8ff103c2-283d-4a75-a928-859f7fa767f6", "comment": "Malware payload (Stealc)", "value": "3955f3550b2be54d7d7f6e0a4595d5a5be8b5af09b65cefa897e729f00d73034fcff97a3485fea66c1b302b28ef194a6", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786456473, "uuid": "883d1744-cabd-4fe8-8099-96b1927fe5b5", "value": "T197A53302A3E8049AEE5993355DB6D15663323DDF5B9406CF229BB29A17331C3D83371B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786456473, "uuid": "003baf1a-6944-4ae5-a2b5-d9ec483163f9", "value": "013c74198fc6e42dcf33737d6c40c012", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786456473, "uuid": "5038557c-d280-4e77-96f1-2437a219f44d", "value": "49152:7GbTXKHahFR2zvvRpNVScqDN3Dxu8AWcOSnF:7GbTKHNDvRpzScqDN3D5onF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786456473, "uuid": "b9604750-fff9-4084-ab89-dd86e1540c80", "value": 2078720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786456473, "uuid": "f523bb76-0476-41fc-b9a0-59750e03f403", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786456473, "uuid": "4f0de86b-6a54-4e4d-9a13-f8181b438a00", "value": "BestLoader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aae5498-95bb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786476599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476599, "uuid": "786d5d86-a08b-426a-940d-9e74360dae7d", "comment": "Malware payload (Vidar)", "value": "ecbb70ce34c38b43c2ca18e4cd439aea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476599, "uuid": "1c88e566-25fd-4d29-aa66-9c3b872e364d", "comment": "Malware payload (Vidar)", "value": "11a1ac70f09d2c0a976b07a6cc8f699ec074ae7ce81b8b10bb1faf05a8048d05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476599, "uuid": "70fc6b6c-10cc-4111-aa6e-871a2b992ce2", "comment": "Malware payload (Vidar)", "value": "7100ee9f1b614d24f3614fa521711150fb763240", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476599, "uuid": "7b3845c4-c547-42af-b6c8-e5aafb63222c", "comment": "Malware payload (Vidar)", "value": "80e24e79cb4f24e7575f7c8a27e4fab5f430948c04f643bfc385f1156c01e879b3a21d6877d1f09c9e323c23ba578a76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476599, "uuid": "996988f1-30c2-4aa2-bb31-377d3e56d484", "value": "T1DB265A07BD911DF7C069E63188675206BAA4BE4C5B3273E32DA0BA742E333D4AD35B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476599, "uuid": "447ae934-57f3-4401-a1ce-3a2bb4c642b3", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476599, "uuid": "8a69a69d-2c38-429a-8483-a7cd48815285", "value": "49152:ln90zTrImrzZwZ5FTuNMQ2KV6/UNdGB1tbFxFyjb7xmcpGeDjw/DmCW9Isdxl9hN:lwQ+C1tA7qyieZrcqOw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786476599, "uuid": "ee8476e3-3dc9-4aae-8791-8d1c799f6238", "value": 4813680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786476599, "uuid": "628272b1-b386-478e-bdea-17ddce9fcf89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476599, "uuid": "39e52129-4358-49df-8364-85cb55f59b2b", "value": "11a1ac70f09d2c0a976b07a6cc8f699ec074ae7ce81b8b10bb1faf05a8048d05.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "617163c4-958d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786456988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456988, "uuid": "44301108-ac60-48bb-9a16-532afff20103", "comment": "Malware payload (Mirai)", "value": "6d17901670c644d1dd18143109afddc4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456988, "uuid": "d0996030-dd9c-499b-aeaf-ddc08cd055f6", "comment": "Malware payload (Mirai)", "value": "11f81e7f540c5df68d47fb454c5b278b17d55367a09b57c550198173dcbc0518", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456988, "uuid": "8a21b5cc-3a89-4a2e-a39f-b89de2f9b291", "comment": "Malware payload (Mirai)", "value": "5a39fe38c2576dc5a96e32bdcdfef6f2cc7b6c93", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456988, "uuid": "6b33f9f3-7a47-4766-b681-65c30e7facd1", "comment": "Malware payload (Mirai)", "value": "6636ed65fb877c731a1a901b83c40b01065c969574e12eeaab7c8dbd2f0c28b2a02b121adb5f49b3f65fc309f745535e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786456988, "uuid": "e3e3ad01-9184-450d-a185-4f6e84c8e31c", "value": "T1CCE06CD5224E6F316417B583F30309E57101E2DE68A72BC45DCD7C28955F455740CF4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786456988, "uuid": "e087bf37-6cd1-4e59-a9be-556c2a55eb7d", "value": "6:B9Ii1rK5AC1VP5f5AC1VNsK5AC1VXVV5AC1VKf5AC1Q:kir8xP5BxS8xXRxKBc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786456988, "uuid": "9d596d9b-65e9-4986-a545-d83d88b9a539", "value": 418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786456988, "uuid": "6b7d8650-884a-4a42-94a2-8f64f927b38a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786456988, "uuid": "88e7ae95-5448-47d0-b9c9-39fc2953a1dd", "value": "jaws.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcdf02f6-95c5-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786481300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786481300, "uuid": "04d4b8fe-4611-4e91-89ee-082fe64aa642", "comment": "Malware payload", "value": "a223372993fa43c8a490104328c4b0c6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786481300, "uuid": "0e79ca35-c586-4b27-8de1-e96ee3b10ad9", "comment": "Malware payload", "value": "12504fb745d55494cf86628cfb53cb2d5d4d205abcf3296ffb94b784e12293b4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786481300, "uuid": "f65e039d-2aea-4f1b-b409-a20bd6c891b1", "comment": "Malware payload", "value": "fee87a1aa1284712f95d21fd3544c99f936ecef8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786481300, "uuid": "3f08c957-21d2-45d4-9a69-214391d72a8e", "comment": "Malware payload", "value": "5ef297628978d7f39f4d1ae3a1cd773679a4fc1c7e2a1ea4c38707b3c6f0a36578663c2f82d455752da369cbe2d3f341", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786481300, "uuid": "89c08c6d-65d2-46eb-a103-f1b257d6168c", "value": "T124C27D956A867C44BEC94A3E4CBD2B1D6DF5C3D1324D42AC3D8A3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786481300, "uuid": "9b76bc15-bd88-4a3a-be69-a44ec80bf56f", "value": "768:+R8vCB+25j6es8R99FYpMSUpi+20qUpi+20YQX:u8l25Jrd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786481300, "uuid": "a571aeef-49a0-4ded-8bd5-b9a15a8b8234", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786481300, "uuid": "73fc035a-4018-4831-a06f-d086284e588e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786481300, "uuid": "5fb3d188-0fda-4992-938a-d6973408363e", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e76ea13e-954e-11f1-bd95-42010a9c0009", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1786430154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786430154, "uuid": "0dfbc959-cda0-4664-9417-8e726efe431a", "comment": "Malware payload (VIPKeylogger)", "value": "1549326c6922ccba3d617eab1047d499", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786430154, "uuid": "b2fcba6f-2648-4e11-bc0d-a58491f30c28", "comment": "Malware payload (VIPKeylogger)", "value": "1298a13d692d2c7fb6fbb24c7f755a05425c042105f05b18d42bf6422af8cd27", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786430154, "uuid": "99b5dfd4-fceb-46e2-81e0-de8c69ae4ca9", "comment": "Malware payload (VIPKeylogger)", "value": "054e45543038321223eee49593706c3d3014f027", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786430154, "uuid": "c4d64784-dacf-4428-9ee4-2dd84c8b8115", "comment": "Malware payload (VIPKeylogger)", "value": "5cc4e1dce85e11ae88d6cdd11284fe0c66c290c82138eecfd7065ae11739814c319de1d4d7f521732c81d459c8789cb9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786430154, "uuid": "15558dee-b61b-47a7-8888-c7d6c479b326", "value": "T1EEE5F6421784AD727331AB9C963AEDF0E50A551314C6CB1630ADFA187B6CD0BA758BF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786430154, "uuid": "5f66e3b3-edb5-4bb9-8596-45b6d08a874a", "value": "49152:2yGusxJceh6NgLDhMCiKc+qdNij+ZFAYCovQPwExQbHfUrOLR2s0ESjoQfQvS+ev:cusxCC6NSDhMCijdK+ZFAYCo4PRuUrs2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786430154, "uuid": "e8925da0-abba-4330-932b-42885926404d", "value": 3127438, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786430154, "uuid": "20f707c3-7c08-48a2-85c7-7e523f350234", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786430154, "uuid": "77820be4-c867-478e-a7f8-52a460f5e726", "value": "BESTELLUNG.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3be4c5c1-959e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786464226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786464226, "uuid": "0ca7394b-7383-49dc-94c0-988356de4835", "comment": "Malware payload (Mirai)", "value": "12e93e0372e951585e4fa1cb593c06d8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786464226, "uuid": "72de506c-e122-4538-892f-8e9b293dbd3d", "comment": "Malware payload (Mirai)", "value": "12d754a8f7876a3fb2b563f7f333813e4d386e9287bdd5776a353ee53dbf7b4a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786464226, "uuid": "2a5ce55d-ce98-420f-8186-120e6a30099b", "comment": "Malware payload (Mirai)", "value": "e9f4b57b657bf0221a8ae590accbdf6522ca1928", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786464226, "uuid": "edab0077-d81c-4864-9273-7bdfe352bee4", "comment": "Malware payload (Mirai)", "value": "fa6cdb217e5a52e31c4cb9da9e6f55939a93d83294e191fdf289873be352ff1ea767f2ca8c1d0636774ebe51fc687054", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786464226, "uuid": "959e11ff-bac2-4386-b6d6-c9cbc0e885eb", "value": "T1D3964B37B6A2859CC08BE1746ADFC5F3F974B4F40221206B27965A327F36E900F6D691", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786464226, "uuid": "8665511e-7b10-4a9f-8bd7-24285cece4bc", "value": "196608:f1vuK1Yhq6OdSDL8DCpWSjxkqgSzif3n4Vs:f1vu7c6OduSSzif3n4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786464226, "uuid": "c2c71e97-2f06-4217-9905-9bdd591f5adf", "value": 9447087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786464226, "uuid": "a7493058-3805-456d-8431-78b1b1ccd7d0", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786464226, "uuid": "3e7acaba-c490-47f1-8113-3c25db96b737", "value": "log", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9fb9f33-95c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786482020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786482020, "uuid": "87754110-27a1-4d40-8113-6326be5adad4", "comment": "Malware payload (Vidar)", "value": "37c80a0ac66b58d3da905a2c82664726", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786482020, "uuid": "aff3e465-62f7-4c0f-b16e-415e25c7a225", "comment": "Malware payload (Vidar)", "value": "13109ad659b2faded3d4d9ef3188564a2b67c97e3f225090c9b3ae732c49884a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786482020, "uuid": "e13a8718-32a8-49ac-b5d9-bea533a444ae", "comment": "Malware payload (Vidar)", "value": "926f9475e9c9bd8b8989d0cedcb216c98cb48ee2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786482020, "uuid": "2c62831e-23b9-44d5-9baf-e75ea65e7252", "comment": "Malware payload (Vidar)", "value": "1f04f4b12b4e511530833b86f68b71da3541c564ce3aa0633cd5b89010b4c6458e2f6fbd01e46d5b3550e83fa6f2268a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786482020, "uuid": "fc5152f5-0cce-47ca-a1b5-eacb66b2a798", "value": "T10E269D07BEE19975C098A33189B60641B739BC0E873633E72E91A6B57F727C18E75B10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786482020, "uuid": "e5954ec6-9221-445f-96cf-3332f25134b9", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786482020, "uuid": "07344f45-5a2b-47d7-986b-da7610981747", "value": "49152:oEst3rc/lW3OjoqKv4F7TvDjI0kPs5Lb8Uk/Le+iLz6EnuU0gNGhGD:oEs54Kv4ZTfI04s5n8UsFEzluU0atD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786482020, "uuid": "a30aa2c6-5c4e-46d1-a7c6-1c93400405fa", "value": 4458664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786482020, "uuid": "1d4b7397-89ce-47ad-bc8b-c40ee440b2a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786482020, "uuid": "ef6e5ad6-0f4e-4d5c-8533-52f0176e98e4", "value": "13109ad659b2faded3d4d9ef3188564a2b67c97e3f225090c9b3ae732c49884a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f712f65b-95cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786483868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786483868, "uuid": "f3dedbf8-1aeb-4a4d-9385-19b36191fd85", "comment": "Malware payload (Vidar)", "value": "df0327fa30f7272f07ea94f847e18720", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786483868, "uuid": "44a73074-8f0f-431e-bbb0-1322d34f4b59", "comment": "Malware payload (Vidar)", "value": "1316039caab6e2d8a03e4cd883d6a3ca6d8e2b4e41f172d4192e23c06643c116", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786483868, "uuid": "c588d0a3-50cc-4639-ab88-fefb28f12a44", "comment": "Malware payload (Vidar)", "value": "7d66076d4762d82c743a60ce2e6ebb6cda3c3d21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786483868, "uuid": "473f59fd-7e2c-41a0-bf78-f8357bd91696", "comment": "Malware payload (Vidar)", "value": "df5a5086693230543df58a09b86d73cab499991bf2f5dc6c41091c7b561a4fec24c16ccc01839832616b7c05249ec93b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786483868, "uuid": "1b179979-c9d2-4d63-a90f-1c9e7ffa9be2", "value": "T155D59D0B7D9159E9C8D6973649B252913B74FC490F3223C72E90B3382FB2AE09D79B45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786483868, "uuid": "501170dc-df23-4b1c-9a29-f707bd72624e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786483868, "uuid": "1f3e7df6-a02a-48f5-9e42-00b0e94668f2", "value": "49152:+UBLCn5DbrO/vHdEmiOA5mwfSv90uBBeKWyYEjf+N3:+UO09EmNAiFNBnWDRV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786483868, "uuid": "52d3a9a7-64be-45d7-acf4-80a117ba3ed5", "value": 2995072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786483868, "uuid": "3c8e103e-0f15-4ede-8078-a1a849aa50c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786483868, "uuid": "6fb9cc5b-6e64-48be-84be-2a8587e682e9", "value": "1316039caab6e2d8a03e4cd883d6a3ca6d8e2b4e41f172d4192e23c06643c116.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71346254-95dd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786491374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786491374, "uuid": "4ae93405-7079-4f52-b899-b309b6a962c2", "comment": "Malware payload", "value": "97b8ae7ad5b72e280e2d32c7fa50ac04", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786491374, "uuid": "0a8edd62-f254-467b-b5b1-d12ee8d06f48", "comment": "Malware payload", "value": "132d62628761a08b16d743a63e9280b32f3bb28825b6814de4ffc94e3b5fc3c0", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786491374, "uuid": "7b74a657-4305-409a-9388-188c6bb67810", "comment": "Malware payload", "value": "ce8b0091d84cf6fff4d8c73b8b3fd6978375c670", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786491374, "uuid": "83f7a2a7-8a68-4d09-8e97-4c6d2e73a7d5", "comment": "Malware payload", "value": "295a2b358925707c6e036d2fe53253be22f09ac4d0db22bcba36762910b0b3e9a57786a33b775e2cd1c185a927d772b6", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786491374, "uuid": "5e8c45eb-6422-4a9b-8349-1968fecd1744", "value": "T143F633B5FCC51D30D90A7F71D2D46E840B8291FB1E1E9D296BA2D4371E9ACA5082CCDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786491374, "uuid": "76de8be0-32fb-4108-b05a-04eaa5546574", "value": "393216:O7IsP+3hvD6fEQb+ur1BKEyYTFnvtsAA6IQnsNAI3yc4JOg7RCfOE82bB:O7IlOf/b+6gQFnvtsAq2sNZqOg7g2Id", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786491374, "uuid": "fa5094c4-124c-4623-b51a-fcf99a2a5814", "value": 15931935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786491374, "uuid": "4b65339d-61af-4977-b08a-74ab2743a6be", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786491374, "uuid": "e071f1c2-adcc-4ed9-8d99-d67de55cf58f", "value": "EapTeapConfig.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efb6d8fe-95ba-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786476554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476554, "uuid": "28a064b4-847c-4b37-be8f-4dcc3f4977b8", "comment": "Malware payload", "value": "af972cdbfd953dcbaab42547c047f97d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476554, "uuid": "3fea6eae-8e4e-44b9-a559-161fabcaf7f7", "comment": "Malware payload", "value": "13acf2ea45449563dc2c30cfff3d9ca62e6e00718ea7b73cad6bdc026d738d8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476554, "uuid": "33913983-0b05-4362-b993-ff9b27339c30", "comment": "Malware payload", "value": "14ceec8001458fd78ed04cbf8415c95bbd79089a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476554, "uuid": "812899af-6efd-4fd1-9bfe-e58887a2333d", "comment": "Malware payload", "value": "3066a41592bbf48d88cab34f6ed454b15444cc97076885594994b117a41cae38694499a3dedb8da4d990f38114f123c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476554, "uuid": "889f3afb-c28e-42ed-9603-ee63214c0108", "value": "T180265A03BDA508F9C09AA73189A752527B74BC4C4B3133E32E50BA782F767D15E39B94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476554, "uuid": "c3ee1929-c0c6-4b8b-904b-9ba026865ae7", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476554, "uuid": "2661d80a-397a-462b-ae5a-e4ae6cfedcac", "value": "49152:4hCf8BveHXu/Yt46Rz56skQWM97lRfxZMrsk5mQqVSBoorWJL+icWX:4yHt46Tf/bVfL0sLuiXRB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786476554, "uuid": "3216f6cd-3f91-4155-96c4-1cada3f7e7fc", "value": 4595552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786476554, "uuid": "f172bfee-6b28-44a3-bd8c-9ea4818e0183", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476554, "uuid": "fd972ed2-7a60-4bc4-b374-dcb47c0a5b2a", "value": "13acf2ea45449563dc2c30cfff3d9ca62e6e00718ea7b73cad6bdc026d738d8f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d9476e2-959e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786464229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786464229, "uuid": "c873a588-93db-4281-aded-37696c622493", "comment": "Malware payload (Mirai)", "value": "7b3b492d8d9ab33a3b97bcee0ec996a0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786464229, "uuid": "f528264a-336d-41f0-9186-2f166a7526f8", "comment": "Malware payload (Mirai)", "value": "13ebbfd63fbaff6689a033692c9b99b88042020c81f7b872cd1e2142f9fb83fd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786464229, "uuid": "e53199df-1eb7-45d5-a63d-7768eb4dbaef", "comment": "Malware payload (Mirai)", "value": "b1597049b4e30e28a0fd3f9447ee3546fe0345d7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786464229, "uuid": "91f69a16-2842-497d-9cd9-5c6461546b45", "comment": "Malware payload (Mirai)", "value": "a44518b2a51a35471c03af766687c9efeb631784edaf74a79b7d7f790dd9dac09af73e1648a639f1d624219537455f5c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786464229, "uuid": "e08eeda5-bfa0-4499-b3e7-0c4a0d13869b", "value": "T138957D5BB7A2B8BDC517823187AF9B246B3AF03513026F3B218891343D17B945F16F5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786464229, "uuid": "0aa844fb-68f8-4a57-97bc-c6339b9d7508", "value": "24576:6VNjYUSUHejrUcKU2ccCCC2qukkkxOBsYFjPyGIbe/:6fjYUSUHejgcKU984GjKGI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786464229, "uuid": "19e53a25-0ce2-4117-a719-20cf7ed93683", "value": 1957303, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786464229, "uuid": "72b9e32b-4f3b-4ba9-a7eb-7bd45e6909aa", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786464229, "uuid": "d07e063b-2af9-4cd7-b0e5-70201e64596a", "value": "proot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d07d4020-956a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786442142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442142, "uuid": "5b3ec3e1-74dd-4f72-9cb1-491679b69724", "comment": "Malware payload (Mirai)", "value": "9f4776c86a445da17dd2662777b85888", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442142, "uuid": "db6061a3-0681-4cde-97fa-0da3967b8afe", "comment": "Malware payload (Mirai)", "value": "13fdcb50766e9fd3ffbb3d19684fa7df0a5b5866b2c7223d2241e15b64a29d3d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442142, "uuid": "a1d351a1-9506-4d7b-8046-7fcbf1e06119", "comment": "Malware payload (Mirai)", "value": "8847d46c8b98c1eecd26095c08425d75d34e1c60", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442142, "uuid": "50e2292b-dc92-4f81-8871-a8efb6e37caf", "comment": "Malware payload (Mirai)", "value": "3636b661d8f7e7c94448876315b5c318ee3ccd5b08530a0710dfe7268053ee5d17e69bbd7214814831a36fa62858d342", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786442142, "uuid": "5794f551-3273-4f0d-92ef-6e8c5a1dde9e", "value": "T16914CFD7B74B09D0CC0602F80BCF5FAE6A2312434DBBC6EBA9697B35543A4CE52157A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786442142, "uuid": "6f293a84-101e-4707-bdd0-74ce081b72e9", "value": "3072:eTEegof0wwFXf+V6gpfPWoawsgSR+/89qbYWgrCuC/i68OG5dwrq:eRcv2P6wsX0LM7CuC/iZXwrq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786442142, "uuid": "3c6d84b1-a5a0-4546-ae4a-5bf4da7ac4b8", "value": 207748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786442142, "uuid": "2125a0fa-79bd-4177-8674-fbfb17e61a16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786442142, "uuid": "68ad88f8-b7b7-462a-9cf7-77df29809ee9", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ab42249-9547-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786427019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786427019, "uuid": "feac14b0-7aa1-41f7-8697-bfaca1517518", "comment": "Malware payload (Mirai)", "value": "042c2b8890128eac4b9785da1ba7c7fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786427019, "uuid": "fce2c9f8-ec44-4eda-bb6d-887fa94edc79", "comment": "Malware payload (Mirai)", "value": "149f1c8ac2a6a0dcb9118c93c9062ea9d24fc52a21c926695530ea365be378b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786427019, "uuid": "06874216-285f-4ea3-b9f4-8715858e7d09", "comment": "Malware payload (Mirai)", "value": "b29e68f46b27fbe17e4b6b0a054e0e34b0ab259a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786427019, "uuid": "5fd9303e-70da-4014-a090-abb8e7f6d4b3", "comment": "Malware payload (Mirai)", "value": "ec4277378ccd8ec0bfdc5afaf361703792ef6ca547dc4fd4a6a36858725091eb3a15e22ff46a4ad9106b8a4d167bf965", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786427019, "uuid": "bfdc2c3d-fd3e-482b-b04c-19ff16400b7a", "value": "T19B241845FD826A15C5C3967AFE2F01DD33234BE8D3EA7323A92C5B70268749B0F6A145", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786427019, "uuid": "2d483140-cb94-4844-8ec7-16f007d89b42", "value": "6144:P9xNdqDzNWSHexVlhQaa/RtXs/auQHeWvU:Pz/qDzNWSHe3lKaa/RtXs/HQDU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786427019, "uuid": "00931421-dca7-44c9-9b2c-f461020d0ab3", "value": 216208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786427019, "uuid": "f073b262-0907-4ea6-9b0a-d0cb5ca311a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786427019, "uuid": "8b7f8557-956b-4a32-9970-b48e78cb8d25", "value": "149f1c8ac2a6a0dcb9118c93c9062ea9d24fc52a21c926695530ea365be378b6.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae678442-958a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786455828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786455828, "uuid": "c148bc90-9306-4a66-954e-1d8f28bb1d74", "comment": "Malware payload (Mirai)", "value": "af5f4c9a690859b472426e0d7967e542", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786455828, "uuid": "b58902e3-5fa4-4f95-a317-eaf48424aecb", "comment": "Malware payload (Mirai)", "value": "14dde083fdf945a4ea87ad7aca1fbd4922f207d685c38379d81a9856c0e55128", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786455828, "uuid": "399fc90e-b1ad-4b66-bc28-4c4a5af91e3c", "comment": "Malware payload (Mirai)", "value": "e44d1798cf24d6d5988287e43782c51514f91ceb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786455828, "uuid": "3568d048-6af8-40fd-bd16-cd71b9916b16", "comment": "Malware payload (Mirai)", "value": "99116c4e134906ab503765013c96d66f2659e136b956e426e3c70110d8d9fcc861a801673e20926e8477d95db924ff60", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786455828, "uuid": "5f1ea31c-08b4-4815-b68e-64c1e91d6cd9", "value": "T1AD832A81B982966EC6D067BFF95E528D336673E8D2DE3113DD118B1173CA61F0A33A90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786455828, "uuid": "da2eae71-c9b6-44e7-90a6-ae5d14887751", "value": "1536:7nMh28cFSUQ3R0MjCYOmkAZvHGaRX+ZR4BaWmPC+J1IydbB:7M28AY3RXjCYOyAG+LQadBF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786455828, "uuid": "5d0abbec-e409-49e4-bc86-2bb445e4ce73", "value": 83336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786455828, "uuid": "ca17fe7e-8deb-46e9-afc7-bb0e7b863312", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786455828, "uuid": "81546386-6f8e-41e6-a870-90531cf7c29c", "value": "14dde083fdf945a4ea87ad7aca1fbd4922f207d685c38379d81a9856c0e55128.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08ed468d-95bb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786476596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476596, "uuid": "731d4de1-331a-4da2-b688-24193afe9e72", "comment": "Malware payload (Vidar)", "value": "7eb0842e143c23527db54c04f3fdfa7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476596, "uuid": "16aac5e6-1c12-43e3-aa55-04f71b79e62c", "comment": "Malware payload (Vidar)", "value": "1564f8ee3f55c7d57ac34c22c2b8c4a9723ea55b7380bcd9f7e9283cd08f3af8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476596, "uuid": "30df0bfa-c33d-440e-b772-08e21d90e786", "comment": "Malware payload (Vidar)", "value": "1814445d458c51d0dd59c8a03674bf99c264095b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476596, "uuid": "17a17667-0f4b-46bd-84c0-c976a36815c9", "comment": "Malware payload (Vidar)", "value": "c5c6111f44bbb51c01c423db0c2a21638a2b2370e010fe3d6680845792f042ace11b35cbc5fd0600f396384818270006", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476596, "uuid": "bfd2093f-59c0-412c-bdb0-394dfad96060", "value": "T122266B07AE9148FAC099E73588BB5155BA64BC0D0B3233D32E60BBB92F367D06D35B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476596, "uuid": "05db4a3e-c6d6-48de-a5d5-511b84d15ecc", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476596, "uuid": "02c382a5-0038-4935-933d-91afd348f40f", "value": "49152:b+cg04U9LjFlfQxSY0785pWkRz91YgMbBsBakp6Zl7Gnk4Kvuubwy1RJPmAzNlvr:bBL4Ump6ZgZY9mMT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786476596, "uuid": "a0159ea3-4a25-4577-bed4-222fa823868b", "value": 4642656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786476596, "uuid": "a54dc7b8-8ab5-4a2a-8ee5-5436e0687c72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476596, "uuid": "1ac88e62-2c34-4f88-a6e4-5f0f7dd58229", "value": "1564f8ee3f55c7d57ac34c22c2b8c4a9723ea55b7380bcd9f7e9283cd08f3af8.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0e1f22f-9517-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786406548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786406548, "uuid": "043f6a90-b35a-4773-9316-4c06dc083903", "comment": "Malware payload (Mirai)", "value": "eb45c920be598f053afb3d56918aa1ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786406548, "uuid": "23a91069-6c2d-43ab-9245-aa0a98beca61", "comment": "Malware payload (Mirai)", "value": "156ee410363b67810416d16a797225ffbaa01cf80daeaff346dabf199f75cbed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786406548, "uuid": "e74150a5-0fd8-4d63-ab5b-7671873f0aa4", "comment": "Malware payload (Mirai)", "value": "95716d70357d72b9e633a0b9d8a80b3daf7b57cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786406548, "uuid": "003a7e23-8c19-4ced-9a99-a0c955ec114a", "comment": "Malware payload (Mirai)", "value": "06ee7749fc79d1a7623dde7d8b98e6e6766158daf8fea5fcee21bcee5762ddb83b8ea1aa5925689b1001d82f71a48d92", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786406548, "uuid": "ab9600ff-41dd-45dd-87c8-9e7b82852296", "value": "T166258D1AB2B2F67DD00BC0304BDBCAB14132F07569322D7B32C5DA343EA6DA51769B65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786406548, "uuid": "b2032983-d51a-422d-a07d-eae06bac8532", "value": "12288:xYd6DCNgKL6dQusl1tUBdoHfjdxAOEDapo1UvOHHaypCoaHXZ9ul/mMAXA:xYsCNgBnudKp6o1YOHwkl/mH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786406548, "uuid": "df341021-3dc8-43f7-9b64-51cc15c6f668", "value": 971096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786406548, "uuid": "a4473d60-94cb-43dd-8c4d-7473784eafe5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786406548, "uuid": "40db015d-5fe2-473e-8a0f-7c1717083666", "value": "156ee410363b67810416d16a797225ffbaa01cf80daeaff346dabf199f75cbed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85e0c67c-9534-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786418824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786418824, "uuid": "58f09857-709d-44dd-b758-f7d670590afc", "comment": "Malware payload", "value": "0381adafe0e511afd966cda6d54047f6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786418824, "uuid": "2396d2a4-3ce0-45df-aabe-986bbb507a6e", "comment": "Malware payload", "value": "15f53ef454897cb60b0331189d7251dfb2e097dab446ce0dc3e392a988146ed8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786418824, "uuid": "6ddfdb65-20d1-48e0-a0c5-d437d3cd2faf", "comment": "Malware payload", "value": "1f8ee7090daa0e9e76fd1e635b28347064b0d326", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786418824, "uuid": "32f14455-5e13-4b2e-b188-c539a3335d0d", "comment": "Malware payload", "value": "a72d635fd38ee1e6831501f65bcd8cece25eed077257eeda81dd4d480fe88eefdaf766e6a07b8c3f49e500e86d869a63", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786418824, "uuid": "9110201b-7f6a-4874-907f-d5f114376aee", "value": "T1D53141AE40151E310107CECE32B2394CB2CDA9FB189FD7C5DD080ED9868879CF261B59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786418824, "uuid": "f8d019f3-576f-40e0-ad3a-136f17ba5a3b", "value": "12:UAi6AokczumNSi6NSN0wc7dA6Y0srZRF6j0+qUNNd6NE6OIDm629R/ZB6Zpl76PD:Tyozujwc752ZSzqgbfrk2y2UP74/T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786418824, "uuid": "46f8ac6c-640c-4200-8cac-d258f3ab41c1", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786418824, "uuid": "ea73eb4d-a8b7-402a-880d-d9a87cdf715d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786418824, "uuid": "9a4d70bf-2186-476a-bcb4-8cba027bf838", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa8fe576-9526-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786412872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786412872, "uuid": "02ae3c77-75e6-40d0-8827-109dfd3bfb9d", "comment": "Malware payload", "value": "69a2b4d34c7efb1394ee4319bfedb862", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786412872, "uuid": "bcc8a6a0-fba4-4f57-8807-c387fee66fc8", "comment": "Malware payload", "value": "163d2225f3f683055419afa274721e28e62b9894be4944dc425d9d2b27b6cbb1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786412872, "uuid": "7827ac75-4afd-47ce-863a-cd189d5d6a6f", "comment": "Malware payload", "value": "96e6606d9cec10f436cab9d8d9658445190a6060", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786412872, "uuid": "a6e44675-ec4c-4e07-962d-d8f38ea6492e", "comment": "Malware payload", "value": "d12bedfdf6a7093876834897629d445a37ae59c337bd8c4cc472a30e12953325e7ee750085a62720d1d07d457cfe3fe2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786412872, "uuid": "f1af84bd-fd26-498b-b1db-889e3d89e5ef", "value": "T178D32A667B10AFE6C36CD5300EF28AA54AF6195219E394823375CF1CAE7051D289FEF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786412872, "uuid": "49cc6630-0b02-4459-8ddd-f3603ebfc1bc", "value": "1536:TX0c6tlv83cAK4Coy6Y8bqpUfGBMBBZoImmOGUXcAY8nEcxl8WdfCzMguIbcYUhT:rapGUXFYKEcxuWd9gNYEtAzfO7m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786412872, "uuid": "cb776108-6aa5-4eeb-b7cb-b13c03d73d0f", "value": 140032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786412872, "uuid": "b10dd23a-3456-440f-8bdb-0af743a80387", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786412872, "uuid": "15fd320e-0f2f-4bea-a9f0-ee5e493100a7", "value": "main.mips32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5c4c1a2-9595-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786460592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786460592, "uuid": "c24d68a2-2e47-4f12-82f0-46c82c37a220", "comment": "Malware payload", "value": "8b91d0e2650a11d487b8b6f7a3758bef", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786460592, "uuid": "a43bffa2-1c8b-4bcc-b0f1-c5ecdf7d37a9", "comment": "Malware payload", "value": "16514af53142c68a055d6816d4c02c805bcf481ffa3274cd672f5c285b1c3e0a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786460592, "uuid": "dbebb36d-fc6e-4aef-b981-fbd8761f56ab", "comment": "Malware payload", "value": "7da68f163ac0ed61b1d7c4f835f43225c23dc77e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786460592, "uuid": "524bc315-0117-4d60-b42d-9b267a29e053", "comment": "Malware payload", "value": "0e4e7c2e1c292c3a3353da2d13c9120ac66a0429bc3b4c2940fe4fc9b7853a360c21d22a5d46698408697ec027bf8602", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786460592, "uuid": "989ecb9b-e547-4ab5-95ed-4d1eb32b40cc", "value": "T13D235C6516857C15AA99C4371C7E2F0CBDAD43E6320452DE7FCE3CF28C4AA9DA20971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786460592, "uuid": "de7056d0-981d-419b-b379-a30f877afbe1", "value": "768:gcsr0a1ldns9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:ehBcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786460592, "uuid": "61945c13-8ffc-427e-b445-bec3a09d5862", "value": 50035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786460592, "uuid": "ad1f1c18-edc1-498b-ac08-78c5ac492dd3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786460592, "uuid": "f9062cb4-dd4c-49f4-88bd-d4fca9344790", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5178eeb8-951a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786407569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786407569, "uuid": "77e92fcd-bff9-4817-8960-9bf355f43d4b", "comment": "Malware payload (Mirai)", "value": "b70cff4a2a0cbde6933d284853425df5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786407569, "uuid": "2ae000e2-ff41-4b6d-b1db-691d5ea5595d", "comment": "Malware payload (Mirai)", "value": "166eb2c6aabc4d4b8bbb0e9571aaf5d2a97a2cb1f22ca84e0d42f22d8ff4a920", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786407569, "uuid": "4f74cc91-595e-4fdb-9580-41e9f3d135c6", "comment": "Malware payload (Mirai)", "value": "3dbfe89fe23f405908feb20a6072937c94464ccb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786407569, "uuid": "0c3c6531-f40e-4b4f-a1d3-cabd77d366c5", "comment": "Malware payload (Mirai)", "value": "9bc4c3bd5acb33ec718e3607051f292ed3e0702af31d6876b4e5a3e2b76bf708d4783a11e209a026191dd38511b7cdd1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786407569, "uuid": "c77dc92f-d06e-44fd-b495-4a569dd2cbbc", "value": "T1FDF34B02B71C0947D1A32EB43A3F27D093EFE59125F4FA44694F9B899275E321489ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786407569, "uuid": "28fa32cb-4d32-43cd-961d-c5b7114d370d", "value": "1536:ePMQsptbIlq404OD0Q2RYMu7a81+xiAB6bHS5byP2QOCcryLvAy6a0c9JFqWr6Vi:+jE4rq0Q2o7a81+xjBAYBQ1crPyhEG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786407569, "uuid": "a94eac04-df71-4a95-81a0-b1b952fc0f07", "value": 166400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786407569, "uuid": "e1b86b47-220f-483a-bb67-08f6ce5f5952", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786407569, "uuid": "53b25622-834e-4341-803e-a2faafa1419e", "value": "sdfjgnjsdf.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faff5d1f-95cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786483874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786483874, "uuid": "bb3a39c6-558e-4093-b238-587dbba434be", "comment": "Malware payload (Vidar)", "value": "1252d6b421a4e447bd63f21882122962", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786483874, "uuid": "ae53072a-6106-477d-9b10-2bd3d0588201", "comment": "Malware payload (Vidar)", "value": "16c8424613e4fd9c7cd5c90465844033bd6f339f2881afa0f02d692038a6b29d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786483874, "uuid": "06aa70de-c62c-430e-9905-5b6c5eb1c479", "comment": "Malware payload (Vidar)", "value": "650b1fc5f2c7ad1d74697cbdddd3c5d44cc5f672", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786483874, "uuid": "498fd3bd-a590-4673-a817-606c7dd7745b", "comment": "Malware payload (Vidar)", "value": "3761ccb7b9763d7cc569bab338f3d257d34a8e5a4c522bc69c611f8e13a6ffb3bccb45f5bf8f5dd4273043074acc140b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786483874, "uuid": "659af3e0-9534-4d08-b3de-b84addaca6ab", "value": "T1BC168D07FD9159AAC49E9335C5B742827B7CBC090B3637E32E60A2792F323D19976B14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786483874, "uuid": "15edf161-4dab-4dbc-a2ab-0c6d6fedd925", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786483874, "uuid": "019a9d10-e5cb-488c-adb1-849b756da70c", "value": "49152:nf9s5ZXF1NI2NqFI1WE3LnGpi4ouruvempa6SjoQ9:nUqItsLr9yapoQ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786483874, "uuid": "03857e99-e7cd-4cf4-b99a-70a26466127f", "value": 4081512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786483874, "uuid": "1fd8dbbc-c267-47e8-8bcf-8943a5baa30c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786483874, "uuid": "29980bbe-2797-4b55-bdcd-33c18fe7a68d", "value": "16c8424613e4fd9c7cd5c90465844033bd6f339f2881afa0f02d692038a6b29d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "185ded92-9534-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786418640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786418640, "uuid": "e00d861f-0199-4747-8a72-cdbcf3648b7e", "comment": "Malware payload (Mirai)", "value": "d82ad62dad4fad08057f97c83bd78b1f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786418640, "uuid": "ca5c3ba6-57b8-4c6b-b945-0cb78794ca3d", "comment": "Malware payload (Mirai)", "value": "16d376fdde66ef3257c859f2cbef01a6945a118533ba31ee4746f84f73758226", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786418640, "uuid": "7ad97779-1e61-4405-81c5-eb28252e797d", "comment": "Malware payload (Mirai)", "value": "9ef37ce71407c29503183ee013921f90333e655e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786418640, "uuid": "42d1586a-a72e-4133-bc0d-a70f9767957b", "comment": "Malware payload (Mirai)", "value": "b95b17e3a053649c9412d919aa2a8c252dd26f009340cc235f53e777a66ddd1845385cf7b649c3dff5656debee64042d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786418640, "uuid": "16fb8553-cfbf-4413-a226-5e792356de40", "value": "T1717302A4348281A2F07B7D7365FD0F816A740F627807B8713993FA9159D68EA8DD7CC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786418640, "uuid": "7154fd08-fc67-467a-af04-ecbcf10afc11", "value": "1536:E21pO8XZYSgO1LWfE7p6iLgeZ0YH2B5bIXaLWRP4ucV1c+:npX0EZLgeDH2jyRPQV1x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786418640, "uuid": "813875ed-cafc-4e2a-8d78-e0216132e7c5", "value": 74792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786418640, "uuid": "55ba17f2-8b69-4982-8747-434d7df0030f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786418640, "uuid": "1fb07525-e037-48b2-ad38-1229ac7f14b8", "value": "putita.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "730d2498-9596-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786460883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786460883, "uuid": "f78a6ce2-cc91-4836-8652-bd9c9624d240", "comment": "Malware payload", "value": "7595afd4b9b31e9001c9c3c2a506b3d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786460883, "uuid": "0abdd2a0-9bbd-483a-92b3-869c4b8bac92", "comment": "Malware payload", "value": "16df4f29806a6bdfddb5dcc62a8145719447dbdcbf4b3c11544bdacf95e30b76", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786460883, "uuid": "33278b5d-5052-484c-a12c-646bb31183e5", "comment": "Malware payload", "value": "29b52c6c208b59d53789017892d2bf0c3f943b50", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786460883, "uuid": "06cddc56-a1ec-4230-9a38-ecde41d90b96", "comment": "Malware payload", "value": "28071e00e2cba70c545fdca364da18e0b6f05ed1414473f6ba756fa7892bbbab2975226db3aa23e0f69a575f14e6e8b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786460883, "uuid": "956d475f-06bd-476c-8755-c9bb65c20f48", "value": "T130636DA5ED0E7941E2D5E335EB5A4BE1A12F3CB0C35644B37A02718DC4EDADD8ED2206", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786460883, "uuid": "23168943-df4f-458e-b295-03c0c7823e81", "value": "1536:ytgpjNQ6HkNAKLckyKgxvFEIsQojfDQUrQ:ywRkSCclvxvFEIsQiDF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786460883, "uuid": "4089e1e8-2fa1-41a4-9dd6-c6303fa474db", "value": 70720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786460883, "uuid": "ac84d271-8bd2-4007-be70-35ef4623c957", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786460883, "uuid": "e29f967e-df18-49f4-a392-f56c4b70158e", "value": "main.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b86cf070-95c2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786479897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786479897, "uuid": "20d0c7c2-c2db-44a5-a5e0-ff3defa90568", "comment": "Malware payload (Vidar)", "value": "25171d7225dbe079648ac2fa68fb67d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786479897, "uuid": "606d40a7-54a9-4dab-a8ee-ce72a2990c25", "comment": "Malware payload (Vidar)", "value": "172a28a070ecce10944fb885bc7bf43d32593ee9438725d6ae5ed7b8908c973d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786479897, "uuid": "9de04028-2f48-480a-a6df-36503453ad1f", "comment": "Malware payload (Vidar)", "value": "af3e431a1cf307ca020208ef545df339254f60dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786479897, "uuid": "b63da3cc-eb9d-45cd-99db-3a5e4d8d23c9", "comment": "Malware payload (Vidar)", "value": "0d2199d361f86c372e01b241d12fbea8c83c98b6459f9782a56fa2ec448bdc53f7b9ba1c30fe3497390bd3270c2858b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786479897, "uuid": "d95165be-62c4-4bb4-b6c6-3ccfc24556e2", "value": "T1C8565A13EE5649F9C199A735C8B74616BA60B80D4B3133E31E52BE782F723C16E74B60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786479897, "uuid": "e4423f29-c39a-4a7c-87ac-95814811ae61", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786479897, "uuid": "1bec01fb-fbfc-4340-b0a3-6dfcc1718d22", "value": "49152:0aBHhgZO1XIg26i7IfmFSu0IHfscg/etWGKWoVLKa0sPJZ4Yd/55TPEDAacE9Ef:0aaCyWGKd2Yd/55DEDFEf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786479897, "uuid": "ab2f20bf-6f35-46e3-a67e-2b3d686ddf94", "value": 5959024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786479897, "uuid": "709f4978-778e-47eb-afdc-d8bce0331345", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786479897, "uuid": "ff5411e7-19d1-4a37-83ee-86600a144a27", "value": "172a28a070ecce10944fb885bc7bf43d32593ee9438725d6ae5ed7b8908c973d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e30be95-95c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786480256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786480256, "uuid": "b8af27ad-6ac2-414c-80a9-55cc0f0e85d7", "comment": "Malware payload (Vidar)", "value": "7758e82d33b0af5c0d16c1c005875c1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786480256, "uuid": "769ac4a5-e154-431f-b28f-e1a41b5f384b", "comment": "Malware payload (Vidar)", "value": "17a40880292fd293027ea0020dad1a0a21d3fb93086f031b6e1b725fbba38f0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786480256, "uuid": "e8a0e4a1-1554-4268-89e4-6a9bd1278876", "comment": "Malware payload (Vidar)", "value": "5848d11fae54fc9afa3dfdf36ed403750265ce09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786480256, "uuid": "17da89dd-bdec-4e74-adcf-0075a3539435", "comment": "Malware payload (Vidar)", "value": "fdb5fc33062afd62f4c1b158c7805980d7d0fe3cbdcf6f5a034defac9ada84e795d4f08dc80e051d8b7740f5eff69df0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786480256, "uuid": "6e7d3c9c-5849-4b62-b700-db46d8d4d827", "value": "T189165A037E9448F6C0A9E73588AB5252B674BC4D8B3173E72D50AEB82F763D16D39B40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786480256, "uuid": "b7a65815-3d01-407c-94af-8d2178514e7a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786480256, "uuid": "c684d4c8-5517-4db2-9d48-5e0654ac0acf", "value": "49152:KIAqycEsriVGb1sVKqwOo87MwAgT1MaRzKTvwdVCPaAs+1Di0Ssx1KI5ae:Ko045sV278X1jHdVCPak1DiSB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786480256, "uuid": "032259d8-0965-4c0a-b1a7-4ebe8a898f65", "value": 4405616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786480256, "uuid": "dbdad031-ff39-465f-b671-650f79df95c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786480256, "uuid": "aef09795-a09b-4d1c-8fb2-dc7a5c7dc47d", "value": "17a40880292fd293027ea0020dad1a0a21d3fb93086f031b6e1b725fbba38f0a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44887f44-956f-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1786444054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786444054, "uuid": "df875e68-88d0-470f-843b-6491c94f3211", "comment": "Malware payload (PureLogsStealer)", "value": "17734864904d450104ab46e262797f47", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786444054, "uuid": "4bd928b7-fff4-4163-89d3-3f2658228cb2", "comment": "Malware payload (PureLogsStealer)", "value": "181be5dc450b80840b8d5eeafb09f35645b430f5ac2910f3abaf477748dadf1a", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786444054, "uuid": "d06e7abe-6549-4b6c-8d4d-4bcb9aa1211b", "comment": "Malware payload (PureLogsStealer)", "value": "db24b1fdeba493b442ac4d6aea6f3c8d05a3691a", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786444054, "uuid": "292893a1-714b-4156-a653-e83bb4d01089", "comment": "Malware payload (PureLogsStealer)", "value": "46a6afaa7672586d7c01f4ff284c5be1d7f6a0cad1e99fb63210380d91621fb855dfeb09074301d255a7e6eb3b5f13e9", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786444054, "uuid": "d078e73c-c7ff-4566-9430-d7ed865ff3c9", "value": "T1AAE59E243DFB502AB173EFA68BE47496DA6FB7733B03645D1091038A4723A81DED153A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786444054, "uuid": "aabd6b1e-84b6-4be2-b954-021e12f49c2b", "value": "24576:M8SiSdl5VWDWg26xdFo9L0hlxLC0U3sSBIQn5iR7fav1wTUAjuSjrohCkZeMlHkE:rZSJVWDsMy9QhnC67fadN2swqX0vY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786444054, "uuid": "f17133a9-1097-4626-bbbf-e3f6c668ad9e", "value": 3124224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786444054, "uuid": "afeb7a02-ffab-433b-b23a-9edae6506082", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786444054, "uuid": "eaf38422-354b-4d59-9a5e-9bbe4c697b2c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "476e85a1-9589-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786455226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786455226, "uuid": "ef5146e9-eafb-479c-bb17-ee01a1ee4f94", "comment": "Malware payload (Mirai)", "value": "d742a7af68e847076ae2a7b37d49593f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786455226, "uuid": "43f84299-6c37-497e-be16-53de596ab962", "comment": "Malware payload (Mirai)", "value": "182184db460fb4354a43d0eb6f421a247c370494bfd287a26e54c39c45cf3403", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786455226, "uuid": "a41e4f23-119a-40f0-85b6-279a0977582f", "comment": "Malware payload (Mirai)", "value": "b6e288e91308fde2e507c75fdba39f121a7b5f0a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786455226, "uuid": "341c9815-7776-49ee-953c-b58f765dd9a3", "comment": "Malware payload (Mirai)", "value": "bbe6b5ae05f7df871b36c3f89cc3f6fe17128300ef0f4d4524a4c5b78b7448aefe2488a41ecf76d35b6b1a0157ecc366", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786455226, "uuid": "f78a4f44-6465-4318-a334-4e91b3128da2", "value": "T18B34C61F6E228F6EF269CB7447F74D35975823D726E1D681D2ACC2101E6028E641FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786455226, "uuid": "4cb0fd65-0240-451b-83b2-7b08c5eb6cd4", "value": "3072:Duw9sEeUKXkW+7YmNC6oXS8VC8xvb1eIq0CNCxg+AB:Duw97ZK0W2NKYsD1M0CQbI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786455226, "uuid": "25df15be-6235-4582-8fc4-1d2e679216f7", "value": 244452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786455226, "uuid": "0611a3dd-8618-45b7-8695-d944ee70bed0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786455226, "uuid": "fc8cc65c-ed09-4640-adbe-2781d619e781", "value": "182184db460fb4354a43d0eb6f421a247c370494bfd287a26e54c39c45cf3403.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23e4e842-95bb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786476641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476641, "uuid": "d1bfb088-ee16-4783-8e5a-59af18bf3937", "comment": "Malware payload", "value": "ada68a02bb7e6c88a79569bd04235aa9", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "unattributed", "colour": "#1869C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476641, "uuid": "1217856b-9e09-4b5a-bb83-40b6a4bf10ea", "comment": "Malware payload", "value": "187bb4d0506b6eef790ed7428dc96b17268ad40ef42302f7cddde0863511d877", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "unattributed", "colour": "#1869C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476641, "uuid": "885815a8-b380-44cd-bb19-7901e75af17b", "comment": "Malware payload", "value": "f19482dcb4553d8a7a3d1204a74eda0bc8e2ffdc", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "unattributed", "colour": "#1869C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476641, "uuid": "01da70cc-37f8-4f46-8a27-279acdb0ea17", "comment": "Malware payload", "value": "aad73a7cd66b8cffb54ce48c41640691134ce140520275c9cfb9cc5328de4f156d8c70127cb1574bca3c14e92bc4fb10", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "unattributed", "colour": "#1869C5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476641, "uuid": "3670d499-2d40-4b19-a87c-22c5722814aa", "value": "T10B034A751BD93DD9CFA8E404B7BE55E8232A7B13412578EF802D2E99741E8BD2084C9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476641, "uuid": "12324bb3-3a17-461a-a47a-d3ef3719de83", "value": "768:5auYyDquhWIzrFF8hS4JHghuam0qHGC/c/Ar7P41DpMvOV+HFXY+ee5aWdFm96:I9yuu5iSighuJcSH52+HFXY+55dFm96", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786476641, "uuid": "e81e1da2-fc4e-44fc-9ed5-5a051ddf77bc", "value": 41075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786476641, "uuid": "f876aa2b-b683-4a3c-b9d7-f7704044d8e9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476641, "uuid": "a3ecee84-d900-46a6-ad42-92c432775057", "value": "187bb4d0506b6eef790ed7428dc96b17268ad40ef42302f7cddde0863511d877.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cba5fdb9-9525-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786412498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786412498, "uuid": "34489db1-8cde-4e54-8e60-0528b88ce9ca", "comment": "Malware payload", "value": "6b3bbc1b30268b24b5bc156f5f4f3033", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786412498, "uuid": "a121605d-5674-426b-a57d-59ace4da6143", "comment": "Malware payload", "value": "189a03e754ec12e37efe0ba49a7982d0ad10d524fdc509f414575ab5264d7978", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786412498, "uuid": "47530c86-c248-421a-abc3-bfa8d8681f15", "comment": "Malware payload", "value": "804926d0f672d0d6d8d22a80e9a830119f1ad3f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786412498, "uuid": "f0114cc8-91d6-4087-9360-aed42f8c9e30", "comment": "Malware payload", "value": "a901e701cf08b8180f7dbccadad189c70c987bcf7879ec6e2b03afbb9c53e3e66ea3217263dcc19fb24d1f4012c98194", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786412498, "uuid": "b9fb87b9-5544-493f-9145-6197554b086a", "value": "T19ED30B03ED816EFBC41ECD70453DC24A15DA5CAA92E5A26F71F8C98CBBBD20546D78C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786412498, "uuid": "f6652b75-22b0-4cce-bb6c-3d220ceb8991", "value": "1536:V5nmf/5on7ovvbq6Knp5sn5nMkmv5A2XMv5995L2WGLIaEri3kU:bman7o3s5s5nM7HXMv59/JliR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786412498, "uuid": "265f94c0-e038-44bd-996c-8422804cafc0", "value": 140032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786412498, "uuid": "b7372c53-2dac-45ee-92ea-ffdf248a8a73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786412498, "uuid": "d22830c5-81ff-4ecc-ba6e-6b3e4bcd04a6", "value": "main.mips32r5el", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe271de2-9569-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786441789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441789, "uuid": "348d881a-759f-4879-98dd-046759fdfdb5", "comment": "Malware payload (Mirai)", "value": "479180566d85f4bba5633c2220c1a974", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441789, "uuid": "a0669f43-7baa-4664-b62a-621360a72ea8", "comment": "Malware payload (Mirai)", "value": "190dd4d9a66655e6744ccf956af1e85552f58de4556c6dd80af113e64721597a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441789, "uuid": "b3b4e29c-62bb-42aa-a4be-546685d975a4", "comment": "Malware payload (Mirai)", "value": "5e5de5c112e1b007631b1f4d658b86162c8245c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441789, "uuid": "cd5e5979-a2bd-40d2-a40c-6ebb0efd5735", "comment": "Malware payload (Mirai)", "value": "cc667b782d61e047c8c10ee251269524aa1289ba9df1392bbfa90b39895d08a92e76cc351eff342d564a9c3ce8e379dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441789, "uuid": "90004669-7416-48ad-b7dd-716b3aa1ea43", "value": "T18FD2D031199A9DB0C8B82539DEF99A8F778712F8E3DCB6B671090F50768148721DC9A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441789, "uuid": "55eb47b7-e7dd-45e3-8de2-05cea5bdd82a", "value": "768:KTCd7jAn81mZa7DSE875FXLF9YTBIMs3Uoz+B:TdPo32SES51F9QYzo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786441789, "uuid": "86141c78-4645-4d2c-9eea-e9869b5fa75f", "value": 28824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786441789, "uuid": "7252b8b5-64f0-499a-ad29-232674b6d95b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441789, "uuid": "a9eea200-e86d-4839-a52e-0946b4cba702", "value": "Mystic.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2322f79-9534-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786419005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786419005, "uuid": "d8e30a2f-9800-4486-a95b-4edcfce45079", "comment": "Malware payload", "value": "ed3f26fd4d66264c25be95c72a9d6106", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786419005, "uuid": "00fad378-4e77-47a9-96d2-17551ad98421", "comment": "Malware payload", "value": "191b0ab67716c4cf0c7fae12b8fc8391a64a154eea567fce5851708974916050", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786419005, "uuid": "6b57d83c-2c64-402a-975e-ef8a71ce9b09", "comment": "Malware payload", "value": "cb82d295a6755f9bfad13e01a0dce6162c642ced", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786419005, "uuid": "3139f98b-9919-4b31-8234-8c7badaa9789", "comment": "Malware payload", "value": "3542dc3d8fcd252934a8a680e053d8154b7c7ba79b1f4ceb054f6312130c92ee02e235871ad37af9557fd042a3c776b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786419005, "uuid": "4b4cb9a6-6ce5-4c7e-b7c9-241b5cf48382", "value": "T1AC531994F844D635CBD035BAF71E029D73130FB8D2EA31158E219A357BB79194E3BA42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786419005, "uuid": "2347c8b5-5a59-4f94-8ca9-dbf420bce583", "value": "1536:1DEHqjbdQCz2jak8wKcoJfFfS3/Oc8msFWLzwIMsPVnIjxMnmwNanfOFk0r:1DjinonY/J8m+WLvMsMsmwqOFR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786419005, "uuid": "7fc32765-b972-4a55-8e60-2dabcdbab375", "value": 66448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786419005, "uuid": "1572bd9e-0604-4959-9869-ce35397ccb35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786419005, "uuid": "081c1ce6-299f-4583-9dce-6bb20b552683", "value": "main.armv6-eabihf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "291cf7b4-9569-11f1-bd95-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1786441431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441431, "uuid": "6344b58e-82df-4b32-826e-0f8f530518b7", "comment": "Malware payload (Gafgyt)", "value": "be0b31c0299b99767a910aa219385fe3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441431, "uuid": "e3ba5236-8937-4abb-9eeb-9b99e0848b64", "comment": "Malware payload (Gafgyt)", "value": "196772edc837099074968add1bdf7bce8a94feb0df69721ca6327e9e877e3965", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441431, "uuid": "6fae1cb8-ac99-475e-a0a3-0d105f19d3d8", "comment": "Malware payload (Gafgyt)", "value": "d84a90fbe227547f2be08d123b1853bf81725890", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441431, "uuid": "44aaf4e4-c9f6-49ee-94e4-6fe06efafd5f", "comment": "Malware payload (Gafgyt)", "value": "a7c1a0d0c476a9bf6aab6ae52c3ced3c9b28d31baf061b0c5c1841630f071b4466d88fe4f3bc31585d23da3ac29a9822", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441431, "uuid": "4c160938-39ac-4d9c-bd4d-b9825c88db7c", "value": "T101A32927F242C6BFC08752B52BDB99A19473B8F81B32721B73D47DB52B168C92D19B01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441431, "uuid": "5bf6a2ab-8e0a-46fc-b91f-9d70bd31d5de", "value": "3072:0t9+V3oPXrtxswdkMjhMnficLwVhaOflUmrxppXFZYZrgo:4PXRXkM2fxqa7mrxppXFZYZrgo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786441431, "uuid": "6551d489-a7a5-4dba-9ede-6b1ad9cfa52e", "value": 106700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786441431, "uuid": "a368e50d-ca29-49cb-a211-05e97d132110", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441431, "uuid": "49928f44-766d-4822-bf37-91df06bde5e5", "value": "x-8.6-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0a60787-9593-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786459725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786459725, "uuid": "d6996427-7e4e-4fc5-9a4f-a8ac13ad84a8", "comment": "Malware payload (Mirai)", "value": "afa903b261e01e01dec6d4325364e243", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786459725, "uuid": "eb9782c8-7a14-4b39-a490-e9848de465e5", "comment": "Malware payload (Mirai)", "value": "197790c50f16bf6b5e372ae0e406a0496c50174caf0fa3ccaebcad4c8d71d8b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786459725, "uuid": "f3ee3626-a488-4014-9a6b-4f04f5c16e92", "comment": "Malware payload (Mirai)", "value": "b86018afc6b7b6a07bf2d94be027ac29918a4ae0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786459725, "uuid": "48a9a2c1-b3a7-4685-a7ff-b08a73c31636", "comment": "Malware payload (Mirai)", "value": "d46985c153e77aa315299f28d2d0575efa3dc45e154588cf697cad12a9c3b53be8086cb434805371513ee01007d5c4a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786459725, "uuid": "7bdc4a94-4077-4905-9344-bbd50a53ea2f", "value": "T121044AD7F900DDBDFC0AE73A48530909B130ABA114435A377263787BFD7A19A0967E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786459725, "uuid": "01a61711-f5e6-4fd7-a75b-29465b63af1d", "value": "3072:vszbV1000TVxOMrQRCTP5MHy6VGXcLV/OoWXaZp9dyP1p2V/jbiaLBvzaEyuxb4:Qn000RxOMrQRCFMHy6VGVoWXa7941p46", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786459725, "uuid": "5652ceca-345c-4f1a-88d6-d024f084e659", "value": 188492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786459725, "uuid": "7fed7e15-0403-42db-adfb-f3c33a157bce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786459725, "uuid": "efdf8b85-2a2e-4cd1-b1ae-ec8628ebc274", "value": "sdfjgnjsdf.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "594e117f-9533-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786418319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786418319, "uuid": "c25d5e37-be29-4fd9-97e1-5e3b58c32f2d", "comment": "Malware payload (Mirai)", "value": "99bfeec64a61d03ee2db7bf1f50dacf9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786418319, "uuid": "cc7e24d5-5380-4590-a4be-dafdad59d612", "comment": "Malware payload (Mirai)", "value": "19dced86c5df301040347205aef6641c7d8901d20f0ad29b05a4a5f4561008cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786418319, "uuid": "d96cef2e-0f08-4f7e-a172-d3fc248d0d71", "comment": "Malware payload (Mirai)", "value": "1c736ab8789d47d2650a873ecb0036f5490bb8b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786418319, "uuid": "10b682ee-453e-42e5-942a-2fbdf9b910c4", "comment": "Malware payload (Mirai)", "value": "9285e09d22bb9ed21023ea5fbb251a65eb7c59bc281ff0736fdebb99bc198b8be87ab9b7525df1dfd977f89bf2f64c79", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786418319, "uuid": "0b867bee-2e4e-4f03-add7-365dabadc388", "value": "T13F147E01FB090953C1931EB41B3B0766E37D9D8318B9F019190EBB569733AFA96C7B89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786418319, "uuid": "300b51b0-113e-4898-b9b8-263e84a85c06", "value": "6144:9P82+5qi8u7zY0yzSeEW5jAAcedfqgRTt/5MTn:C2NuDedRdAr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786418319, "uuid": "a6ff9209-80ca-41ff-bf7a-9a1b49c0a2b4", "value": 198040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786418319, "uuid": "97e3aa39-ede1-4490-a3d9-f0f7102b52a8", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786418319, "uuid": "321a8985-7417-4846-9478-db2317cc070d", "value": "putita.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6f4bfd3-956e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786443817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786443817, "uuid": "25e32ae6-6de5-4667-ae80-2ffda1d776f9", "comment": "Malware payload", "value": "dc8b7196f8f3112ca5cc3869754f51ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786443817, "uuid": "78eed8d3-7922-4446-b38f-969c68bd1e8e", "comment": "Malware payload", "value": "1a0c3d520e16ae12ffa918032e608f573b716f009a05c35f64b53f128bf7376d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786443817, "uuid": "6a30d1c7-9d20-4226-808d-2ffaba101633", "comment": "Malware payload", "value": "2de45087cd0d10396f9c95ef9842780eb5cc1f2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786443817, "uuid": "8e91866b-44c2-4e60-b648-0740e0ee6e22", "comment": "Malware payload", "value": "5ae72d432f9efc95ebfe63771f861e425d2ea104ce6cdd6c1443eec27da5d05f02fdde88c62611b623fa2e91a8248f91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786443817, "uuid": "81753564-7547-47f4-abd0-2b513f5fe6fc", "value": "T15563290AB35364FCC42AC1B442EBA737EA73F86606316F7F5764D2312E24D906E2DA15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786443817, "uuid": "d70acd69-997d-4182-ab75-e1b6e24d96d9", "value": "91d8be4f49246c5818d6b02af88b4166", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786443817, "uuid": "0284b2c9-59a4-4a8f-9650-2546c1e331f6", "value": "1536:WRbPvnj4oJLe9AeEgvGRP38HjbmJhEbWg6Hg6IW:WRLnaFHnmwcxH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786443817, "uuid": "a9093307-0d9f-44f9-bf87-2403b5f2cb2c", "value": 69120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786443817, "uuid": "f821ad7d-df31-4dc4-8285-ccea674fb83e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786443817, "uuid": "bba933f7-0b26-4be9-9d65-6edd084759cd", "value": "1a0c3d520e16ae12ffa918032e608f573b716f009a05c35f64b53f128bf7376d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6dea448-9527-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786413403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786413403, "uuid": "52587a5d-ce95-4e2c-9fd6-98ff55317af8", "comment": "Malware payload", "value": "fa5e5d0ab876eb2097c9b1f1c330547d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786413403, "uuid": "02ea706a-35a7-46e0-a302-1736e6406df9", "comment": "Malware payload", "value": "1a10aa47242d1d71b422dff69b286fc69464f3f132692e2a1daff7a17cbaad99", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786413403, "uuid": "a11d3003-f8bf-4fba-8a52-40701db26a1b", "comment": "Malware payload", "value": "85d0a441ed61943b36c346dde8772521cfc3821f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786413403, "uuid": "067bb8ee-cbc7-4d6a-aa16-207037849ca9", "comment": "Malware payload", "value": "68149631dc570d4746a19ea79ec545d8fd894f6b9c49dffb1b14b7a854b46d3f6792aee64ed9e8c6ff25bc3c4549d66d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786413403, "uuid": "55601b0a-09b5-4681-970e-735257888284", "value": "T1B3539C81B60EBF9FD0A22A3FC102465E3F74ADE0A5036633D5A27A2396B71731E5CC45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786413403, "uuid": "6189f92b-7a73-4ced-8893-9ca4dfad271c", "value": "1536:mLNNDCjvAD39GFPufcBqI0upixOR9MRqy8rY:mxNGv2taPufqL92qyUY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786413403, "uuid": "aa02b874-a2c1-4e2b-bba3-5c8f306e5883", "value": 66208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786413403, "uuid": "84904910-bb46-434c-a06c-434bff6e928d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786413403, "uuid": "2b5a595a-e466-4e56-be58-abb9fe7b931e", "value": "main.m68k-68xxx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47ff679e-9523-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786411418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786411418, "uuid": "2a46e9f6-f901-4c02-ba52-c07891757875", "comment": "Malware payload (Mirai)", "value": "eb11e3060da489cbc23aa313dcc137c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786411418, "uuid": "6c91755e-4059-43a2-8179-433274912055", "comment": "Malware payload (Mirai)", "value": "1a52e179c51c3ce5b3ea3529f9c95a3fbd1fdced9d2d7476d4ffdfd40ac1d134", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786411418, "uuid": "418c38c6-3ece-4ab7-98b6-88e97be99a85", "comment": "Malware payload (Mirai)", "value": "fef06645cb43dd98ac14bf202dcf35df8f7569e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786411418, "uuid": "6204a426-6130-465d-9722-73979ca421a6", "comment": "Malware payload (Mirai)", "value": "11d84640a14745f296661451a5562a6daf269dcaf1a7742134cb342ac7efd291a4b69c846c1612b3c55179e2fb81ca2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786411418, "uuid": "7424cda6-ea6f-4d34-8177-4648eeb00758", "value": "T1AE531A94F840DA35CBD075BAF61E43DD33120FA8E2DA71158E319A353BEB9194E3B942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786411418, "uuid": "c052a209-722e-4fd7-bc66-ffe939c23100", "value": "1536:7Fs//7u9uMiyJdFTR7+o3IWdpM4nDoBmu/zoYeotFL+d8f0rL:7C7R4L3pMiDo8uDeE68UL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786411418, "uuid": "d9ec91d7-3b9c-4343-955f-2a1b9b1a71d3", "value": 66440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786411418, "uuid": "a1f699fe-bf49-4ca3-9510-4cd916d107d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786411418, "uuid": "7f7423cb-0f13-4b00-9e97-b037fe884089", "value": "main.armv7-eabihf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22f7c9f2-954a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786428107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786428107, "uuid": "5a510eb9-86cc-4845-a214-0e4216911227", "comment": "Malware payload (Mirai)", "value": "49fa6c94d620d36a3e94ff5632bb0cf4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786428107, "uuid": "f3d295fe-634f-4334-82ee-2ba775c0d2e7", "comment": "Malware payload (Mirai)", "value": "1a8ca4b7d55f2cc3eb315b4e5872a9dd0bafb82153751fc56b0b02ae47190458", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786428107, "uuid": "dea6bdc4-4b51-46b8-9e4e-4f5fc93a7800", "comment": "Malware payload (Mirai)", "value": "60d26b006569c6d3902e510142e38ec7ee562b5e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786428107, "uuid": "9b1bf102-3896-42e7-991e-cfb192bf920e", "comment": "Malware payload (Mirai)", "value": "563853e106c70a500c1cf192d082cfc18ea22eb646072f9a6cd2e12a7dea48c69ef9750f0dc0c0d160e020419f04c97f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786428107, "uuid": "9d5b496d-cca9-46e5-a279-7cea965ccf8c", "value": "T157E31946B9519F12D5C331FAFB9E814933136FB8E3F97102AD246F60238A99B0E77512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786428107, "uuid": "cfefef79-3c25-4142-8c56-ab345f8b713f", "value": "3072:xNQAtZG/Ca4Rqwv2C2ubvHJ+qwscLIaCpdnoTBC84NBcptHHzuGIYFk0+qiBbdK:xuAtZGa3RNv2FUUpVIaCpdnoTBCSHHBj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786428107, "uuid": "82b4e901-48a9-445f-b2b9-9d31968a6862", "value": 154684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786428107, "uuid": "ed306aba-5142-4683-a8ea-13dbbb21b555", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786428107, "uuid": "48338374-e91a-4262-85d9-bca339bba404", "value": "data_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d0e0eae-956b-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1786442458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442458, "uuid": "21a074ff-ef69-4757-96f7-327cc0c9c1ca", "comment": "Malware payload (XWorm)", "value": "ce6938f518576fc404d392d259eeaf1e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442458, "uuid": "22822907-08dd-44aa-9e58-147a4fca6f53", "comment": "Malware payload (XWorm)", "value": "1a9136d68060fed63853979b333bfa6ac4f5e36a2c93119d695e6b5615a43e87", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442458, "uuid": "65cee1f8-080b-49e2-823e-622109a0d1f3", "comment": "Malware payload (XWorm)", "value": "4f3a4bf9f6f6b4ce43f42342b25111d1a7c2872a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442458, "uuid": "e0b99884-5279-4d08-8dbe-4def57f97faf", "comment": "Malware payload (XWorm)", "value": "f50dca065362b8244473caa0187450fb2f9c040526fccfe3fd83b9496cfc9021d1a8c8a99c82dd6f14c12435249273ad", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786442458, "uuid": "e07c0161-ba8f-4201-a1b6-963e58cca2f4", "value": "T17B246C0123A3B85EEF416DF96A0F60AA84F18A02643017F8FB709FF77417563D6A4B65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786442458, "uuid": "8639dbef-1eb6-47d4-bf37-5d27af110fa7", "value": "3072:tu4L9541nVjiMxdvEmjC6mVoG5qRI9nDWID7SDtAIrBy2kYrogILeLtMhx/:H52nF71D+qQ3D7SDTyUoeOhx/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786442458, "uuid": "1da34703-6351-4434-a35b-3b30e298d4ee", "value": 219989, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786442458, "uuid": "e77f37c2-29f2-4575-b84a-4311faf5c092", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786442458, "uuid": "12b61126-400c-4859-9c8c-952617e00159", "value": "UBKTlazrtb.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a5e163d-95bb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786476840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476840, "uuid": "b986922a-091e-4fa9-a982-85b654291d7c", "comment": "Malware payload", "value": "a4928aa03fc2d05814cb841176dbf5bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476840, "uuid": "8e57b57d-7928-44df-aec2-fbb577f1e6e5", "comment": "Malware payload", "value": "1aaba665425e7283b8d51562b94627a188533201da5c95fb0b33f038f8f88771", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476840, "uuid": "5ef2c82d-f195-4839-93d4-a5a4de7b09e2", "comment": "Malware payload", "value": "a701f1bacb799e235890ef62230eb202119f2a01", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476840, "uuid": "9078fd0d-7841-4e19-8fff-41592cf3bfe0", "comment": "Malware payload", "value": "fdacb0625b615848b4175f564ebd23a56154f108007c172de88aa52f7ffa6dca8b043217e4f37b9ee38d6b4a54a15165", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476840, "uuid": "739111e0-097b-486b-b749-016686985e95", "value": "T1E9A3D60FBC5ACAA2CA929934C37F00512351874158BBAF736ABBD21DD76213BD7179C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476840, "uuid": "a609b75b-9e56-4d1b-a76a-2e5b358341db", "value": "3072:pvmXh+g/m9HP7SE5eO3WwEdfAjh4ilAMQMw9cUKWw:pvk+g/0P7t593WwEdfWnWU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786476840, "uuid": "9e9e364f-d479-4a83-8811-9d5372ffdd28", "value": 107180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786476840, "uuid": "2ff5d6f3-68e0-4c12-a86b-a231c53821a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476840, "uuid": "e17582ff-c18d-4160-a0cd-52e41cff3295", "value": "main.microblazeel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74a6810b-9596-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786460885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786460885, "uuid": "cbc2abef-4ed2-4b3a-944b-193d57256995", "comment": "Malware payload", "value": "5d2f663c76905fc2f0dba79a172bab8a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786460885, "uuid": "236e8303-fa3f-4370-9233-e2440a642f80", "comment": "Malware payload", "value": "1abcc10f2715f2499f7c8a868a5f45df1ec9855129cd024c84f74cda7ff49604", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786460885, "uuid": "53249fc8-666d-44b2-ac2e-4671c1d0c0ee", "comment": "Malware payload", "value": "d1b618e088f4802ecea382b7c2bc8c58824b9bbc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786460885, "uuid": "7d3754d3-db5f-47aa-98bc-cb57b1be3168", "comment": "Malware payload", "value": "d15ab57d6644e3ccd951fd9203712621f922f77263b0f198f7a0b5cb076b7378dc77578c4e3998221d9f6dbfcfd8e7f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786460885, "uuid": "7d746974-9388-4e28-a5a5-74de96c6768b", "value": "T155D35B33B7099F63C63D52B04EF2CA3996E1265109E2A195A312DF0C7E352687C2EDE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786460885, "uuid": "fc3d935f-9f21-4d25-9709-0f72d9254051", "value": "1536:lhjNvHNbqHxnWu44Rhana6iRUvmYDt5gVGEs2mW2yRFZ3dSrr9:LqRnWRahaP4Uvmi+VGJWZ3Mf9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786460885, "uuid": "22aea4e5-1a2d-42b7-8c85-e80c2fce436e", "value": 140296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786460885, "uuid": "b102b25d-3cb6-48d1-959f-2b32401c76cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786460885, "uuid": "602d6415-92f5-4925-8394-c68588184ba4", "value": "main.mips64-n32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f23b3ad3-95bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786478706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786478706, "uuid": "b9808592-c1ff-42e2-8485-362fbf7a159c", "comment": "Malware payload (Vidar)", "value": "91ab58b721a03193434dfd09b924f82b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786478706, "uuid": "f275e133-e349-4bc4-9384-cf30be60d72f", "comment": "Malware payload (Vidar)", "value": "1af081f3d3fa88460f4628b335001be0c08ee29a99fcded861949f8b9a8d3b36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786478706, "uuid": "194cb6f2-a048-4e6e-b259-198a9687d116", "comment": "Malware payload (Vidar)", "value": "64683c5023627bc645b9ffb8ec98b53315e3c12d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786478706, "uuid": "eb2c9284-94f3-4316-b01c-f4ae1e1f64f5", "comment": "Malware payload (Vidar)", "value": "72f3acadd7a203785afb441735c3d29827574b1b6d67ed5acdb435ba6b5950c7bb689fa76372cc3e6b5c04cc643a5ebf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786478706, "uuid": "8ed05bdc-16ac-4451-9d04-8c4a51d37e2e", "value": "T1E2565A13AA5149FAC199A735C8B74616FA70B80D573133E32E627E782F723C16E74B60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786478706, "uuid": "fac05018-a461-403e-b6b8-536a5c69843f", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786478706, "uuid": "ad848299-4d75-4cfb-a58e-207214bd9050", "value": "49152:hEfxXypJ87NPJehCOCN7ClddqtVmRTymgau4xWIS4/6+TOxSm/y1W6ajdD0rKuD3:h+X9lNERTyGTTxk2uAHZqVw+K/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786478706, "uuid": "6b18b464-f286-484b-92c8-0da6517047c6", "value": 6265176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786478706, "uuid": "3611a552-c98d-43ba-9eb8-b47cf10fa42c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786478706, "uuid": "464d5e1a-f59a-41fa-942d-9a1ea9723ce1", "value": "1af081f3d3fa88460f4628b335001be0c08ee29a99fcded861949f8b9a8d3b36.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "075039df-9534-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786418611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786418611, "uuid": "8e7bdd37-4e09-4f73-bd9b-dcff8b2201c4", "comment": "Malware payload", "value": "473c870ff67d78f3aa7a12b60e80bb67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786418611, "uuid": "e0a6401d-75c7-4b88-9abb-fb32ed238fae", "comment": "Malware payload", "value": "1b0a340c06c2fa7ad21330e9a06997ae4ca521ce8988b7aaa385454364650e69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786418611, "uuid": "0ba165eb-9cfc-4661-9a94-6dfc4cbffab1", "comment": "Malware payload", "value": "8c6db9890c1548996ea13967bdad64e2300e7c52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786418611, "uuid": "da6db367-4e3e-4235-a2db-3072a36ba594", "comment": "Malware payload", "value": "c7fd5384c7c5c21eb81c211eb2af125dd21e8faec7ede4893d178eaa936afca1985251d84122a00b4ea0b8d62220f4b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786418611, "uuid": "5b76c4ba-d22a-41e2-af11-aaaa6a3fdf2f", "value": "T115A5D03FB28B753EE06A5A3A7AB6E210543B7E61A4134C1696E4E44CCF350B01D3E797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786418611, "uuid": "7a61ea39-0dd7-4517-9652-7ee8335a6058", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786418611, "uuid": "1bae24d7-d48a-4f65-b125-8d7c22aa84d9", "value": "24576:yXNrSLScusMmOvjjhzvLJz23fBLR9DC+UmvcnYTn0eaR+rE4mUzJFZhYJLchafHZ:9uI2hQZLR91jUnc0r143zZ+vFOoljz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786418611, "uuid": "08bb0ae3-d715-4c02-90f1-9f644b69d9e3", "value": 2186048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786418611, "uuid": "038cd845-456c-49a1-ae64-0bb38bcbaf5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786418611, "uuid": "c051c827-c97e-4b60-b43f-5dd967f0d912", "value": "1b0a340c06c2fa7ad21330e9a06997ae4ca521ce8988b7aaa385454364650e69.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39ee8b9a-95d0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786485698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786485698, "uuid": "645e2ceb-dc9a-4233-b967-8ee760ac84a5", "comment": "Malware payload (Vidar)", "value": "e0432bc203b41f8f704ad2f68018c241", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786485698, "uuid": "3d206247-3217-4a77-8779-c335350ccaed", "comment": "Malware payload (Vidar)", "value": "1b4865646b89fa938b340c30177e04c88f5e6a5de227fcd89798ea1113d12161", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786485698, "uuid": "3ec90b2e-8219-430c-9dd4-7c87675f4c44", "comment": "Malware payload (Vidar)", "value": "48769acf0f389ab851da13f140199ab8defc5f7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786485698, "uuid": "a3f67901-7ae3-414f-acb7-3d3f99d4e6b4", "comment": "Malware payload (Vidar)", "value": "252b20d6b81021ec706d8f73485b72991b67da67160daea4d11db9feb26c2aa7f10f4e1c59df6588ce0e59dd003af075", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786485698, "uuid": "7e3be8d6-0901-44ac-859b-cef6aa209699", "value": "T12056490BBB9058B8C484EB34887A5281BA74B88CC736B3A71D52AD746F1E3D15D7CB47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786485698, "uuid": "cb02da32-5224-40ca-b412-a65bd92720c6", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786485698, "uuid": "bcf56a3d-6910-4190-95cd-dc45405dd60a", "value": "49152:w/A/wZMNU4H2o7ta9pJj+wuha2IFPhJxPphSzlPJgYDVgwrkK+KpM4Rn6blCdb3D:wDSa9PjykJMtcK+IYCdbmYF+KLxZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786485698, "uuid": "4b6008fe-2010-4738-bbc1-86726ecd80bc", "value": 6372528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786485698, "uuid": "12150ef2-4072-41ce-a1fe-6387cb165193", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786485698, "uuid": "0df35faf-f882-4bec-94a8-d3b895d87e18", "value": "1b4865646b89fa938b340c30177e04c88f5e6a5de227fcd89798ea1113d12161.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eb0a2b7-95a3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786466378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786466378, "uuid": "470932c3-399c-434e-a9cb-79b40f94517d", "comment": "Malware payload", "value": "21c62631c79df02b691655149c6e8a1f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786466378, "uuid": "a39ad9ff-9eb6-4425-aa78-b8d53ec61b57", "comment": "Malware payload", "value": "1b52a4b79336c3cda7e68c44bd65bb06510596f737bbcb9126a45509205b4e42", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786466378, "uuid": "fbd5437c-c8f3-40ce-a99c-17f572823c89", "comment": "Malware payload", "value": "304de230b37c36c1e926a136dd68c67e7d430058", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786466378, "uuid": "99b7ff96-df9f-4106-9789-4849cb769b86", "comment": "Malware payload", "value": "97ddf0a007cf8bf7fe9a0a22b3f15168bc2b1efa61b2dbf1fd1112802f6021f1b2ea03eefae00df2a1716bb556773b1e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786466378, "uuid": "6aa6e207-4f4c-405c-a896-76c367098786", "value": "T17B9633D7EEE692DE246C092952A1F319F66915FFAF8EC81131FA141176ADEF80816C03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786466378, "uuid": "4258734b-3976-49aa-aa0b-843c342d7d43", "value": "196608:YgHVgz0uqBON76tRRV94lDyNp82lAUBJYMrwd5P:Y8Uae76jRV94lDyI2WUkMW5P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786466378, "uuid": "a3756e2d-0b76-41ea-995e-da3256e1fdc5", "value": 9124166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786466378, "uuid": "fba54bf3-21ea-4175-a34a-d17befe275d1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786466378, "uuid": "639de988-e016-4403-aa7b-bf50c487a53a", "value": "exportUsers_2023-4-20.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5856eff5-9599-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786462126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786462126, "uuid": "f4e9dbc5-751a-4714-a7b5-a215a1cdc2a9", "comment": "Malware payload (Mirai)", "value": "5794cdd29b4af599dca2e13843c22c33", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786462126, "uuid": "3b1e5674-977f-4b92-ab8d-8952791316d8", "comment": "Malware payload (Mirai)", "value": "1b53165bf1bb568148e479348155838c7cb298c715b3a73216abf8e0c1d2f822", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786462126, "uuid": "901657e5-9a55-463e-823d-460556ba435c", "comment": "Malware payload (Mirai)", "value": "dcf15f03a5ed2a420a8341da52a771f3aaff60ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786462126, "uuid": "dfc02ced-0239-4c70-8d48-b70a1cfb2275", "comment": "Malware payload (Mirai)", "value": "f790565b0e52c6d3b6c7811caff790b277632ad9e8896675a94c1f5455689feef90704764bab9433f28b9f19c00b1ec6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786462126, "uuid": "b5ec776f-9d53-45bb-91a4-bc1e2ef852cd", "value": "T187241946F6418F13C4D6177AF6CF52463333A79493DB7306A928ABB43F8779A0E12A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786462126, "uuid": "c1e14fb8-cd86-45c7-8daf-2eb752d2f868", "value": "6144:11/zYIjco9YvyYNah8uNIGxI1flIhTEHTM/R4VAEksSgm7p:DYnLvyOah8uNIGxYIyHI/mvVSzp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786462126, "uuid": "85f15b68-d603-41ed-9078-fc55038822bb", "value": 213713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786462126, "uuid": "220aef06-f8e3-45ed-b1de-7137e3b8c9e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786462126, "uuid": "2cbf53d7-2579-43b6-b673-01039af14ca9", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00c25ff6-95dd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786491185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786491185, "uuid": "74199414-c207-49ee-bdad-878a8cbdedda", "comment": "Malware payload", "value": "9f57339cd0881fad416804ea50899057", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786491185, "uuid": "107b7904-b572-4fdb-a67a-8e415aa30476", "comment": "Malware payload", "value": "1b6ae02e0a9ec5a1509f389b5865880dc843e6f4efd86da8b1894b7a0f467530", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786491185, "uuid": "8b203a02-9838-4649-9baf-de602cd4c0a4", "comment": "Malware payload", "value": "6a054e51db623644e7696765fa17c3f64912867f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786491185, "uuid": "2565dc4a-a169-4b14-a351-402b15eb9dc0", "comment": "Malware payload", "value": "23c356b7255057a0d454c0451de6b131a845e2bdd2a173479afa2ff5f61309851d3337c0fcb202e73f10730a2aa08e3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786491185, "uuid": "cd0042df-2fa6-47fe-969a-b571f14cac3c", "value": "T1EF266B03BE9148F5C095E73589B74652BA74BC4C9B3533D32E60AAB82F763C06E79B05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786491185, "uuid": "19652b95-2580-480c-a938-e109abaec480", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786491185, "uuid": "b6fcf572-375d-40d7-b0f7-c6409c331c49", "value": "49152:igH4aDItp1AOlnpToS1DN2dorbkJqIhQDeAubwxAgyh:ijvpTX1RByyyh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786491185, "uuid": "0d7c6ba9-83f0-45be-b126-a172f6df8c9e", "value": 4721008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786491185, "uuid": "cadfc913-ee1d-461c-ad89-e383c58d7313", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786491185, "uuid": "e81f28d7-9ec4-4e5c-8855-7e16d32ed776", "value": "1b6ae02e0a9ec5a1509f389b5865880dc843e6f4efd86da8b1894b7a0f467530.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa9e2abb-954a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786428468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786428468, "uuid": "a2632c0c-b718-4a4a-b4df-d83d5cfdd77a", "comment": "Malware payload (Mirai)", "value": "27cfc97d872d55fc572a035917163e1f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786428468, "uuid": "96bd072a-d9b8-4a58-b319-c7f15dd7b7df", "comment": "Malware payload (Mirai)", "value": "1b78a4e7422aa6baca4fab9ca9adca874a89c423a60839d95a62c39a9a934d46", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786428468, "uuid": "4f8d9533-a128-464c-843e-4f830faddd6b", "comment": "Malware payload (Mirai)", "value": "9ec1984c3a7958d499a09d7afd75b82a29dd39e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786428468, "uuid": "bf69df38-9c16-425c-ac27-77986881ec1d", "comment": "Malware payload (Mirai)", "value": "024311ce839981352c6ba72d874e74e83f24fb49933801eee71440005848d7bd7cc3b3a85d186f1c28b7d0e9c45048b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786428468, "uuid": "5ca3e7c3-dd3f-432e-882d-be78ef6e3a09", "value": "T1FC24F606BF511EBBD41FCE3709E5028A319CE49612F93B776A38D459BE2760E09E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786428468, "uuid": "e7811297-f236-4280-aaa2-fe6bfa88e613", "value": "3072:zKB7KxsKpszkl0nKwPMQTTlnCgsVnQr2:GB0sKpsgd2Lndvr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786428468, "uuid": "7d440fc5-68bc-4577-abf1-97fb106f82b4", "value": 224380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786428468, "uuid": "4320b440-a664-449d-920a-c4067d80afc1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786428468, "uuid": "c3791dc7-34e5-422f-9aa0-3cc474e8b1dc", "value": "tmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b9a7e64-9591-11f1-bd95-42010a9c0009", "comment": "Malware payload (LxBaseRAT)", "timestamp": 1786458669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458669, "uuid": "8630eed9-4a46-4bdc-b78f-714455d76815", "comment": "Malware payload (LxBaseRAT)", "value": "49c930aa9fc579976e4a36ff2a0b2417", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458669, "uuid": "f80ee306-7789-4d12-a7c1-5750213cd206", "comment": "Malware payload (LxBaseRAT)", "value": "1bc6eaae334998da9df26e23803d97c537578cd02fa55370c98d418dec186ccc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458669, "uuid": "698320bf-5c08-4af9-bf64-e1dacc98cb17", "comment": "Malware payload (LxBaseRAT)", "value": "efba35b1bf8d7857dbb06cd2fd838fb152b1c298", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458669, "uuid": "d0a15f2f-3ecc-4713-8252-b25b6c2c4d48", "comment": "Malware payload (LxBaseRAT)", "value": "4f2d47b267876759319f8cd873490bd7fd1e048f093ae34147d05eaef070e610911852cb0e50b4a5b41919b850e7382b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458669, "uuid": "6edfeabd-6510-4134-8f57-7cf03c881654", "value": "T1E195C9ADD8335F653996F30ECE46D8E509F36B030E53A1CE949E95AB0422734AEF3461", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458669, "uuid": "856a1ce4-0393-4e8e-ad06-564329a14e87", "value": "24576:JHrQlaAb2MlrY7e6aNIMmCso8RHccBjJ4+O+:7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786458669, "uuid": "95249129-fec2-4805-8583-77d67f78ffe1", "value": 1892103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786458669, "uuid": "35edafd2-22fc-4a68-af33-76942fec8326", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458669, "uuid": "4943895e-aef0-4f8d-8228-64c55bed078a", "value": "Company profle_Project_PYLD_EF38B843.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3cec894-9571-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786445073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445073, "uuid": "49aa0097-f954-466d-a313-2857bf3b8dfa", "comment": "Malware payload", "value": "9edb07dd1440234829a572eddbccc2b0", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445073, "uuid": "586e80c2-9631-4e4f-8907-5c82059fcb1b", "comment": "Malware payload", "value": "1bf054bded99e2ae414154593d0892066b2e0c7add603f9321e157c77ae52075", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445073, "uuid": "4d7045cf-7eb4-4d84-b4c3-6a2b1d4927fa", "comment": "Malware payload", "value": "be563223a1542f4965740ef1ecd10e5c4ec8c10c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445073, "uuid": "d517c6c3-df77-48ad-8a94-b604a0efefe7", "comment": "Malware payload", "value": "5a511e04cd871656940f28e26ced4d5bc36f38c3cd9cfd87d32c6e4fdee0827bb3e2a64b4a05cfa49b9d09408408089f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445073, "uuid": "781afda3-1502-41d7-b8c0-cd4e53a05e0e", "value": "T1C0D7FA37494CA523C5FE68349531B9C726D0A684FBC3E7892A16688D12B27C04B5F9FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445073, "uuid": "ec42b7e8-a878-490f-b3c2-d3155d40eb25", "value": "786432:zzlPF55m15Sv7Niqd5B9HQEN8FlrM3PlHF2q4mPnSot3ujnA:vlPF54/OB9HRQlw/xkgVd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786445073, "uuid": "d7808c63-eb16-4e00-8c32-5d647cb96db4", "value": 59870110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786445073, "uuid": "8910be7f-5ec3-44dc-82b1-baab34113146", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445073, "uuid": "af93a15c-a91e-4f7e-b9a6-c7de77daa0f2", "value": "Alfresco.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "122428f3-9559-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786434521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786434521, "uuid": "95dd002b-3301-411a-9d33-e7f04c9741a9", "comment": "Malware payload", "value": "5859abac3f6bda43c3c8b3ef4623c510", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786434521, "uuid": "dbd880b2-408c-4bfa-bbe9-2f5948408a52", "comment": "Malware payload", "value": "1c1f3997a9df6206fcf39949fb719b46a06497f7ef633c16075622e9c92acd0a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786434521, "uuid": "890d943b-a538-4727-b1fe-9eaf594ad8a2", "comment": "Malware payload", "value": "0b1587a831b63d69f043ebb7db86b3142899ea53", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786434521, "uuid": "18dbe4ac-1c79-44e5-b00a-d07c0e1757a9", "comment": "Malware payload", "value": "dd88ee1c6ab7f2eb34c1a4c71ef61c2a701ca80397d5c509ec39a01b8221313c589b303fdb0bad2d2af758f8f90e357c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786434521, "uuid": "301d6c1f-e598-4972-b523-b1c4f0cbeb52", "value": "T1D393395AB8819B15D5C1027EFE1E528E33131BBCE3DE73129E246F21778B56B0E3A506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786434521, "uuid": "de785d18-923c-44b7-9707-d14c552e478f", "value": "1536:tJniTfoH+n8lxtvsH4o0MjfuW4QBTLmqUIeddCqxk9a02ee+QMfiNon/WbXRqLx6:WTfoe8lfG4o0MKW4QBT6t1pk9aUoon/O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786434521, "uuid": "941157d6-cd02-4d2b-b6c0-a939badc9792", "value": 91320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786434521, "uuid": "a69f3ce3-3b49-42a1-95f7-f81997144684", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786434521, "uuid": "c402ab2e-e49a-4bed-a166-37aa474ee859", "value": "lul.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9566c967-95b3-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1786473396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786473396, "uuid": "0b65a280-b99d-4529-b091-bbacf6a6a453", "comment": "Malware payload (CoinMiner)", "value": "cf97c276e9dfb1e69584f3617f210a79", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KeygenGuru", "colour": "#5F1EA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786473396, "uuid": "e3456b7a-417b-4f63-a0bd-8dc42a0af291", "comment": "Malware payload (CoinMiner)", "value": "1c3512436ae699c6d4ddb61628a030b90c85dae2c0465e879a815b0d3858c07f", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KeygenGuru", "colour": "#5F1EA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786473396, "uuid": "75735252-311b-4393-b217-9bb7aadab26b", "comment": "Malware payload (CoinMiner)", "value": "d395296507053d619512ff30a0ec7b7a268af511", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KeygenGuru", "colour": "#5F1EA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786473396, "uuid": "cdd7e506-0621-4849-9276-84b905729e32", "comment": "Malware payload (CoinMiner)", "value": "7c7406dc21144950eedd854a4d27b7ee302244e7e2a1bcf3405c85360704994572d592965c85e04d644c06ab885aa398", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KeygenGuru", "colour": "#5F1EA4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786473396, "uuid": "298f744c-9176-4e30-a01d-41290dad2781", "value": "T156466B157A9A58ADC05AC474834A8BA36E3170CA0B36B9FF41D482353F6ABF06F3D355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786473396, "uuid": "414790fd-2dbf-407e-a620-c6da82df99d4", "value": "09efe51582ff67cec8e91178d236e283", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786473396, "uuid": "04a0f5fd-1795-4688-8ded-1468bce4a7ae", "value": "49152:e5hsTIZMpvJZtAQMFOdPnFwCtQ8Zf9BE+qsqk0CLdgaeGHk4vxG5a3vuapVrUlN7:DTPfIO5FwoJ0owTGXLEnRD4H+kPY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786473396, "uuid": "207802af-7f87-435d-acc9-14c20b32b557", "value": 5712896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786473396, "uuid": "1bcdcf42-8f41-4a04-bedc-43bc458db61c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786473396, "uuid": "bd6c7b9b-d897-4885-920b-7ed99c68d2bd", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "924194f6-95a8-11f1-bd95-42010a9c0009", "comment": "Malware payload (SnappyClient)", "timestamp": 1786468666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786468666, "uuid": "ba59afe2-af02-47f8-a8b4-c806e441f76d", "comment": "Malware payload (SnappyClient)", "value": "6abb1a4cf0cb24ad61335e8edb97bde3", "object_relation": "md5", "Tag": [ { "name": "cdnwire-packgate-online", "colour": "#CCFB2A", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786468666, "uuid": "83cec998-525f-4c8a-8430-73b5f94efb4d", "comment": "Malware payload (SnappyClient)", "value": "1c42f5b56f4648f0df962e20f72808fd8e54305a1ac45195f9582c88dd5c8c6a", "object_relation": "sha256", "Tag": [ { "name": "cdnwire-packgate-online", "colour": "#CCFB2A", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786468666, "uuid": "49caafe5-12d4-4197-b19e-edec4152754e", "comment": "Malware payload (SnappyClient)", "value": "5a891634ac93c7ded280789af898d45c808eda04", "object_relation": "sha1", "Tag": [ { "name": "cdnwire-packgate-online", "colour": "#CCFB2A", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786468666, "uuid": "88d21226-59e9-4907-896e-e84d54539adf", "comment": "Malware payload (SnappyClient)", "value": "01a63345d6a038e4d82494934529660d2d4c85c9ab4c4f6658e084981f786f696249bf9bd9d96e89436ff9d793fe52a3", "object_relation": "sha3-384", "Tag": [ { "name": "cdnwire-packgate-online", "colour": "#CCFB2A", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786468666, "uuid": "f9bab6b4-6953-4104-9c0f-75cd2d963538", "value": "T10BA7336056EF05B6FFB7F2B4A1618823652D96B930D9A4CF3A3C28704FF36C4571A609", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786468666, "uuid": "451ce3ce-3418-4f39-83b7-d651ddc8c6c0", "value": "786432:k3SxaZaCBbb7K+TtoHCVGXPOXhQOsYseq7nD1QZu0C2:Ub7MHYpQ7Y6vI5C2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786468666, "uuid": "df14e93e-2283-43c4-b8d2-dde50ccdcf9d", "value": 45088892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786468666, "uuid": "69ed7236-7c42-46ec-bf8f-29311e4cfc39", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786468666, "uuid": "6af3e8dd-d562-4d77-b4ee-e31af1e5e034", "value": "Air-Music-Technology-Vacuum-Pro-Crackproduct-Download-69868.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9b4c020-9562-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786438721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438721, "uuid": "644640b3-965e-45d2-935f-a93454323867", "comment": "Malware payload", "value": "742c0e0a3211a4be35641f53ba39eabe", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438721, "uuid": "a1757e9a-2698-4d13-b556-66bf918125db", "comment": "Malware payload", "value": "1c6a0a844808052c1099b7220e33efc8e5e144a878c3c90db7b500a01f949e33", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438721, "uuid": "cbd23504-ea25-4e30-8a21-b36b38b53ed0", "comment": "Malware payload", "value": "abdd64fda8d6d3fcfa750ccf423f33bdde13999f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438721, "uuid": "a814d1e1-e39b-429a-937f-c7fffc81e55c", "comment": "Malware payload", "value": "cb4c431f1b16cf0fa52077b8185166dfd7dbfe282e36694a98b085b1fb546644393e8de0bbe76273d7ce14f9ed04783e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438721, "uuid": "480a09a5-414b-433e-89c6-c89c7efafbaa", "value": "T16BB751120FDA2D49C538AD078FCE500FAA65C40F17BFA75BBF619178F19B29432A84B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438721, "uuid": "a6a02d5b-8d3f-41c2-b458-8e595531fb42", "value": "768:PK93LgTxLkFaZHbFHbdTHTBLCNRKxQgTxk7fBfxKxsNHLsTxkp/Kxg9/QQs/KHbA:JIum/lzlW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786438721, "uuid": "35030a16-0afe-419e-bf40-bb65a9aa8efe", "value": 49848204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786438721, "uuid": "4ebc4f4a-c78c-45f2-901d-7b9fc5aa0442", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438721, "uuid": "f3593792-1075-4b7b-9644-36d42d1e4f7e", "value": "pdf_Receipt_20260811155706.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79ec9d72-95c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786480222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786480222, "uuid": "7e0984cb-2524-42d6-9a31-9872a30c58ff", "comment": "Malware payload (Vidar)", "value": "74c867ce8b79179ba9c0eed8a4f8da5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786480222, "uuid": "3606a96e-a5c7-4a43-8706-22592a9833ff", "comment": "Malware payload (Vidar)", "value": "1c940adff5d5dd1f5a1053256ca6176855130fcb9bb64a265607744ba092e849", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786480222, "uuid": "7bdebba3-c555-4235-a7b3-bf36b461fd26", "comment": "Malware payload (Vidar)", "value": "5d28be67d394643ab430a466433414bb369d23de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786480222, "uuid": "704f3085-2377-46ce-8ab8-b256b91141f4", "comment": "Malware payload (Vidar)", "value": "85d5b4a1a84b53a4978f71eeee93a7dab6ca8ad47534100646100107ca43fcee1ae5cb48498f95c2606a36ba4dada28c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786480222, "uuid": "76e5a8e4-33fe-411b-86de-f87215fdb345", "value": "T126169D07BCE008B9D45A533295A24249BB39FC878B7277D32E50F6762E737C1A939B44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786480222, "uuid": "01aea7ad-df38-4c11-90d1-6c999c713614", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786480222, "uuid": "c8a27bab-4cda-443d-aaf7-ff426c5780b9", "value": "49152:3LXqRZk/FPOgnjsQKu/npHwQQ2Hu69nlHc4Jbj4kC19Mcvrw:3L6RwwmHwbeu6tlHrfCbrw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786480222, "uuid": "3b97a762-e027-4693-9ad3-cc5c2ed33ce6", "value": 4248056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786480222, "uuid": "b22a80ba-00cc-4098-b395-e4c4afd9982c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786480222, "uuid": "d7521cad-2f68-45d9-96c2-3a8c017ee3c9", "value": "1c940adff5d5dd1f5a1053256ca6176855130fcb9bb64a265607744ba092e849.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e5e96f2-9579-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786448473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448473, "uuid": "2b874b9c-3daf-4f69-aed2-18424e3ebd50", "comment": "Malware payload (Vidar)", "value": "ef09f0aaae28cf60cb963eff2afc45f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448473, "uuid": "733331cd-ee9a-44ca-9dcb-6cb0be497505", "comment": "Malware payload (Vidar)", "value": "1d243326c4e8ffc40ad1ed920921136c05fc4cc0b5760d113e7c04a43b21de4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448473, "uuid": "e368f429-4454-4d13-95be-39515bd096bf", "comment": "Malware payload (Vidar)", "value": "bb2c2dd9c44e1f215e13695b416bd28394e96b3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448473, "uuid": "5192d529-c081-4e4a-82d1-b7e82cbff514", "comment": "Malware payload (Vidar)", "value": "ca7aa722bade3c9589c0c65f7323f1c617652d3f83362b92dae00be71f943ac753154c229bd011758ac97e8b90433d8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448473, "uuid": "f6ec2fc0-0603-44ff-9c7e-69473d2c43fa", "value": "T1B5F57C02EDE105E9C09E623189B796527B35BC052B3233D72E90B7782FB67D42CB6764", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448473, "uuid": "95933b8b-56bf-4ae9-b524-80f06fd66321", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448473, "uuid": "66c5374b-21b9-4d63-bbb6-450cee3eebac", "value": "49152:jvwKxYZHOnI9XeKQBxP/TLiTUaHHubBoDIeF:j5ekfYHObQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786448473, "uuid": "82d425e3-d854-41d3-b972-c25e7d700558", "value": 3547536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786448473, "uuid": "9089978c-e4de-42a4-a9ec-e22cd5a13f79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448473, "uuid": "86a0f1fb-aae5-48b5-97fa-2b308e73e909", "value": "1d243326c4e8ffc40ad1ed920921136c05fc4cc0b5760d113e7c04a43b21de4a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "040647da-9538-11f1-bd95-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1786420324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786420324, "uuid": "e983902d-9f6e-4bf7-af49-03488714a3d0", "comment": "Malware payload (RustyStealer)", "value": "390d9af9dc24af25a076ddad66be284c", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786420324, "uuid": "818ab09d-9b0d-4cd7-9282-23e46517a0df", "comment": "Malware payload (RustyStealer)", "value": "1d9de7df85e6cbadec1023b83262fb475c867a8ba3f3b2e805e7e438bef24f63", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786420324, "uuid": "3e2d4fbd-5bef-4b03-ab64-7dec2450deb7", "comment": "Malware payload (RustyStealer)", "value": "3635fe1e1cd8cb681ba51714bd48e4e02b1e7470", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786420324, "uuid": "c2ea334b-2bb1-4da1-aa07-50a1b43b18cf", "comment": "Malware payload (RustyStealer)", "value": "57c8cebcfda6ba27ed4d12fd9c8a68441e01d7818ccb29e634b075865186df3e42c059b570d882da75dcf3692c6c8f30", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786420324, "uuid": "8f0002a3-1d26-4784-a758-ace0add83124", "value": "T10134AF1676419DFDE846C03583458A76F63274CA0B22E9FF13A841383E6BDE66F38758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786420324, "uuid": "44ed5e30-3481-4da0-9cd0-68c72542f232", "value": "f5b9792513ccc1f2acfeef8dbcad6bdf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786420324, "uuid": "5dfe2da5-7ea9-49ef-a2ad-74e041b648a7", "value": "6144:ptOygMY0t1reFH2UBkmDw2H6vqdgYOPiz0QS:pgNBkV2H6vMgt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786420324, "uuid": "79a9f651-128c-482b-a82f-1dab7cc28ca8", "value": 252928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786420324, "uuid": "6c5771ed-59ce-4ff9-9cb1-050c6aea384b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786420324, "uuid": "662cf7be-0c02-434c-ada5-b8d80042f82a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90c2d127-9522-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786411111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786411111, "uuid": "e04e1c61-2056-46f0-afa3-eb2342551713", "comment": "Malware payload (Mirai)", "value": "e8a14edacc5941bf449d124b7ff68e36", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786411111, "uuid": "260d2837-df63-4ba7-b031-1bc310804aa9", "comment": "Malware payload (Mirai)", "value": "1df747a30c57bc640d7403663cd37d11da3b4bf3917b83a7e5a89fdae81b9fe2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786411111, "uuid": "ed354bec-b04e-4291-bd8b-8086d347fc01", "comment": "Malware payload (Mirai)", "value": "17da55aad5210262ad748b7272ca163514eb7a4b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786411111, "uuid": "dff25cae-1bd5-44ab-b25b-2ab51bc98e7a", "comment": "Malware payload (Mirai)", "value": "f326fbb626f5bbfc9e11d985c3fec55afcdc5244e47b7811961bf79f942a29f0fb659f725c6658fd5f4e1b8648e79d08", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786411111, "uuid": "fc4e13d6-9f85-4210-b769-c74cb0fffb6b", "value": "T1D1E36A1BB1C184FDC8D9C2B44BAEE626D932F4595134B22F27C4AE272E5DE206B6D710", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786411111, "uuid": "140099fe-d10d-4e81-900f-d8efb99be643", "value": "3072:bWDvmIITpC4DdXAU19o+FbVPO3Lk+aE1xIgKrT21QVmtM:1dm26keu3itM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786411111, "uuid": "e750d388-d352-4c7e-954f-bf77cc6f98d3", "value": 152296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786411111, "uuid": "e16f2407-a668-4d9e-9486-d58463ce319a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786411111, "uuid": "65c3e59a-9ea6-4f73-953a-1dccb5c10a4c", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7d1a3c5-9527-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786413405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786413405, "uuid": "7b0d871f-7e7c-49be-8a83-19bf0fb3d3d6", "comment": "Malware payload", "value": "b77855a61780a32b0a49e035f38438d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786413405, "uuid": "8abb5fdd-c790-4f7d-860e-8825e3d82129", "comment": "Malware payload", "value": "1dfa46e7c90d88401770795ff748b87bb657c22223fdcfbde199b2fc82412e97", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786413405, "uuid": "b2cf6928-921d-4f87-bbd0-8d006ae60e0f", "comment": "Malware payload", "value": "2117a48a80a241addf8dff539fd8dfb70fd2d420", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786413405, "uuid": "0e870a6f-8470-4d89-8f4e-205362bfc33a", "comment": "Malware payload", "value": "9f8ccc49d6f387dc3304d94bc144892b030bce8d554ea3bac69b3012fbfabb1ea719217be3cdb7a0e835d99d9e0adc72", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786413405, "uuid": "0c033df3-f864-4c9d-ad47-bb5d3e1f5907", "value": "T13213E781F787C922C40A583527BAC736370278E72F67D2108C65EACDFB675D0A9B5827", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786413405, "uuid": "e51b54a0-c30b-4511-85dc-637867f0760c", "value": "768:C/1r5fs+bvgpJSDuF+/uASagVVFh7g+pDDDHL9SD9tUEuGpebC0UIP+vh9tu1a+:CdLgV/RQqEunWIPSc1a+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786413405, "uuid": "59bafbea-2622-4e85-9652-585e6bf27f71", "value": 44484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786413405, "uuid": "28b998d1-6a24-45ae-bc90-f5837b437cfb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786413405, "uuid": "4749ea6f-9096-403c-af5b-b27b48e2a6be", "value": "main.armv4eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acfbcfc9-956b-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1786442512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442512, "uuid": "5ca8625b-ef25-4300-849e-3bcff241dc9e", "comment": "Malware payload (PureLogsStealer)", "value": "2c7a7e8ea2d94daf44851ac5284c8e87", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442512, "uuid": "e3885184-27a3-4f99-9a95-c4d4525806e3", "comment": "Malware payload (PureLogsStealer)", "value": "1e2d1ddf3fbd79437f795edd84d975e8398df3f45db455f6fa4c9320fbe45137", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442512, "uuid": "2397e2dd-ceb8-40c5-9775-f0ba5f425660", "comment": "Malware payload (PureLogsStealer)", "value": "1b8e5a7da4625b06af573170808ba3ea9b7d49ef", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442512, "uuid": "9d5c1bd9-d44e-4177-949e-4f2463701111", "comment": "Malware payload (PureLogsStealer)", "value": "00e877118f168942325e6036cb43645b252601e31a32a93215b3461aa8779f16509e4cbe0e93434dea8c670acd7f977c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786442512, "uuid": "7024e39c-357f-4375-9061-a94e2061f760", "value": "T160C40A3DF1E95328A8621260E7D1A251063EFD8F1F5F226026EF29CDD3B51905643EEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786442512, "uuid": "5255d68b-4337-42a2-bfa3-c7d609cab38b", "value": "6144:QK/Og7KV8Mq8sYeLWT9OksbZ3eDQswjMe8rnc1KUia//tPT7:h7K3q8btajLPV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786442512, "uuid": "15836e65-a3f9-4d62-b46d-cf297339963a", "value": 547342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786442512, "uuid": "1298aa10-4d38-4fb3-b7a6-3e402a4887f0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786442512, "uuid": "23d5a629-e7af-488d-9144-26d20ba7b739", "value": "Purchase_Order_40026979.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e605550-95ac-11f1-bd95-42010a9c0009", "comment": "Malware payload (ACRStealer)", "timestamp": 1786470217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786470217, "uuid": "e6a0ac49-64fd-4fd5-a3b9-049223559189", "comment": "Malware payload (ACRStealer)", "value": "77a89ec6a2bfe5dfdf6cb0a6e2d097d9", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dist-binarypilot-cc", "colour": "#299FFE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "thu-ipad-02-cfd", "colour": "#A44DD8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786470217, "uuid": "b4b82aa3-99b1-4d39-9250-44ee82bf09c9", "comment": "Malware payload (ACRStealer)", "value": "1e5352fed3ca6510912a8c28d09a2245e644ad47f274169dc399dc7dfd3f1f28", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dist-binarypilot-cc", "colour": "#299FFE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "thu-ipad-02-cfd", "colour": "#A44DD8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786470217, "uuid": "46a09b31-83a8-42a3-919e-d54abbf547e3", "comment": "Malware payload (ACRStealer)", "value": "caa63c0a6b4056dd3ba668da54122c4f0ff8eebb", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dist-binarypilot-cc", "colour": "#299FFE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "thu-ipad-02-cfd", "colour": "#A44DD8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786470217, "uuid": "38747157-324e-4ae3-846f-0cb60d8c1d20", "comment": "Malware payload (ACRStealer)", "value": "d58d01d6546827f4905f7fd2d9c34a87fbddaa43e58a2d54c7094f2c5a1aee688911724b72a48204c2af006ae2b7d6dc", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dist-binarypilot-cc", "colour": "#299FFE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "thu-ipad-02-cfd", "colour": "#A44DD8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786470217, "uuid": "77047462-1cc7-4024-9920-fd930e59b531", "value": "T18DE5F13FF28B613EE06A1A367AB2D110543BBA61A5164C1696ECF48CCF355701E3E787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786470217, "uuid": "60ddbc78-1751-40a5-9be9-bf0a75165788", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786470217, "uuid": "fe35b2f5-1002-4464-b3d2-317bec77f378", "value": "49152:4uI2h3ZBpgDwdNMzOpLOBPWFrFxS4cj7Gh4z46RjcACaXKAkld9NleD0ZQ03mv/Z:45OvwwW8IOFrFK7Ghn7ARKzPleeQ03k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786470217, "uuid": "5acb25f8-b100-4373-899a-370da9815b36", "value": 3289534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786470217, "uuid": "8364dfb5-8daa-470c-8e58-4b9a1dfe0d86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786470217, "uuid": "ea7b1950-7fdc-46fa-8b7e-995b4596dd7a", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10853500-9548-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786427217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786427217, "uuid": "19983632-72e1-4f17-aada-aad5e692777d", "comment": "Malware payload (Mirai)", "value": "60151c2dfd54f09522181f197cb21092", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786427217, "uuid": "8ff4b032-e35c-40b1-8b33-fe70624c4336", "comment": "Malware payload (Mirai)", "value": "1e768ef07fb5576fd1e0e0f0795e9d2232d0d329fc86ef6e654a5a52318bd335", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786427217, "uuid": "47d8c4e7-d1f8-4059-8112-4e1d694ff083", "comment": "Malware payload (Mirai)", "value": "db165c79f4e206c8aee9234299eb456b9d986c9a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786427217, "uuid": "d9d7cce3-541a-4757-b096-afaa672b1e2e", "comment": "Malware payload (Mirai)", "value": "2e8422eeb4626e938aea4892c1724431c8c931dd1acfcbf50b7b8917dd3d27590eca900565a904021b533814e65a7963", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786427217, "uuid": "b5f6b841-b870-4113-be2c-9b02cbd53028", "value": "T19A5149C546840E792C63EA57E6F64B7C328395538DF1EB97D9E4BAE0224EC1071A0B63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786427217, "uuid": "d96a3562-723d-4cdb-90ea-df4fa93b4b62", "value": "48:vj7I7N7hjp6GjghzPjZKWjvoUj7v7o7UjfK3bjY9Rj7cgj8pVjhSOjF+CjafTjS2:vj7I7N7hjp6GjghzPjZKWjvoUj7v7o7E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786427217, "uuid": "1e075ee6-d249-483a-83cd-985d402d0795", "value": 2970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786427217, "uuid": "fdda6fcc-4605-4020-8065-126203901a39", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786427217, "uuid": "5d4ee55c-1fdd-4975-94eb-03a4567a3a1e", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "970d558b-9588-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786454930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786454930, "uuid": "386d8aa0-12d4-49c9-9a44-80b21b443947", "comment": "Malware payload (Mirai)", "value": "014ca1e746133d9c85b22fd653abe807", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786454930, "uuid": "2789a187-0473-463f-9b12-037a0a4d128c", "comment": "Malware payload (Mirai)", "value": "1ef4db362dc03450bc437972711c64ac18fa7b44bc9d8d91c2b7ce7f3211efd8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786454930, "uuid": "fa1d84d6-e29f-41da-8ddf-01c045ea8fb6", "comment": "Malware payload (Mirai)", "value": "6d11a6cfaf3dbf10b8348d5ff523a5c8b3ba7c2e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786454930, "uuid": "6e6c71bb-e040-4817-a689-1c749c6a447d", "comment": "Malware payload (Mirai)", "value": "a35e910733c03f322b65ea34c6701078af61473a78f18ba38db3db84cec0b2f0a539e1699b04e2097a9d8ae257eb3168", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786454930, "uuid": "a3a320e7-f08a-419a-9773-4838efe76015", "value": "T134C37DC1E743D0F5E59205F0103BA7269FBBD436A439E752E7AA3D329C63A409A1B35C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786454930, "uuid": "db9c7258-a04f-48cf-91b9-cd6493175703", "value": "3072:ADeHe8NIYwY2ZuVbMQogHCIHHqLwmKfiBhN0jl1+AHf:ADR8iY00YHgiIHHqLwff9pMq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786454930, "uuid": "cc21142c-6847-4e9a-a74d-96a7ccf465b4", "value": 129164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786454930, "uuid": "da25982b-c2a3-44c9-b335-ebb6cd1727e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786454930, "uuid": "9e187fa0-603d-4746-b30c-17e619028127", "value": "1ef4db362dc03450bc437972711c64ac18fa7b44bc9d8d91c2b7ce7f3211efd8.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9ca47aa-9547-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786427098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786427098, "uuid": "c351db1b-ec5e-4d80-b813-2a94ade1664b", "comment": "Malware payload (Mirai)", "value": "c4164e882a22303d5edcfbfa17bd4797", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786427098, "uuid": "6260d17f-b7a7-493d-812d-d89d8ad43cf0", "comment": "Malware payload (Mirai)", "value": "1f0d2646b13115bf979993874dc8c09a09950e1ed89b58b1410061bad51063ff", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786427098, "uuid": "ff05a2fa-180b-4cc1-86a8-28b8d3962845", "comment": "Malware payload (Mirai)", "value": "08abe66dc209d51ba5d2a6d187ea633daafe8608", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786427098, "uuid": "30f9e869-de46-43a5-878a-421fcbb3fb5c", "comment": "Malware payload (Mirai)", "value": "dcf80db3c42ad78cab188e9c72b35e917c98b4f3623d896527b3b5424bbe41dfc21043889a6ae65d39bf9b267943bbce", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786427098, "uuid": "616a9659-9e4d-4ab4-b00b-08e7fd3d42b0", "value": "T1E9C2D0E07726FA31C4206C3DE52A4D8A3A91163C91FF383764258C359EC265B67B88F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786427098, "uuid": "50f849ce-08c1-4198-910f-755716900e13", "value": "768:JMKyhegCCMqfizjoNpd2vJdX6vwrrQ9q3UELua:OKy4qfqoeJdXWg9Lj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786427098, "uuid": "4530e2a3-d24a-4bef-8630-c08ce9b8323c", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786427098, "uuid": "0e5ac255-b563-4380-9e9e-2050f8793b63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786427098, "uuid": "99b1ab18-c1be-42ad-bef1-7e5006a69ee4", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad575754-958b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786456256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456256, "uuid": "cc4f1be6-68f1-4215-870d-794a9bbda19a", "comment": "Malware payload", "value": "468a82aa57605e5289fc1fafe275bbd8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456256, "uuid": "c0e5c3fa-b67c-46b9-97f8-4004eb94d020", "comment": "Malware payload", "value": "1f2ea5252adb413f93bf7e7edff106c86ed0649963f424978755b812bf8727ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456256, "uuid": "191dc0f9-8a4e-42e7-a3c3-7fc9ae4a7185", "comment": "Malware payload", "value": "f57bc94b0a6d6881d7aeba62472eb87f221db809", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456256, "uuid": "13ed0e6c-9992-4e7b-b700-18c40d81f4ac", "comment": "Malware payload", "value": "417decda7febe1dc7413d36a5fc1aac757645661d69cd7934091feba64a3280fdd70cfddcf36d377e9dd553ae3cfb093", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786456256, "uuid": "874da19f-e78b-4b02-b27a-0e451f3156d6", "value": "T126A37330F90667B1CC720A38579A2F096E7705195FEB1A625E1F623DEE768508B30F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786456256, "uuid": "c707757e-d81d-471e-b1e4-5aa0aa0d6365", "value": "1536:4wshrEQ9QHp2duuOduuuuuuuuu7eKVpRwvuEnsatHHC//ZekFB8M6hxP8+QJ2YSW:2lEQ9lYWRwvnxYZl6LFa23i7lszUd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786456256, "uuid": "c2e33d00-ccb1-447b-8062-f1f4bf6632b2", "value": 107180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786456256, "uuid": "646da476-5d66-4aa8-8820-fe195333c8fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786456256, "uuid": "e299d478-0f20-47f7-89ef-46797d436dc7", "value": "main.microblazebe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5083588a-9562-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786438491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438491, "uuid": "12a63071-5788-4600-9f18-ce98dd1f0a96", "comment": "Malware payload (AgentTesla)", "value": "67469443274f03cbb93d571689b78f8a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438491, "uuid": "ff065625-f71e-4035-84b1-896e764fab9d", "comment": "Malware payload (AgentTesla)", "value": "1f482d15d435fb1e8bb93ad976d05ce19588d538ffe3190e03685a1ed78d54be", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438491, "uuid": "4424273c-8c7f-415d-b791-754f4390b4ce", "comment": "Malware payload (AgentTesla)", "value": "1cb89ba0a2f45e0459d3704057fb13416c07c2d8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438491, "uuid": "b2740f5a-872b-4dff-b5fe-7d9e8178463e", "comment": "Malware payload (AgentTesla)", "value": "b5824950648a999f58f5e02edc13dc6d242aafb2d6c336d24ebe02f52686fea264675acffd62b4dc2ad3518a30aeea90", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438491, "uuid": "3fff1ff8-f6ce-4641-93f7-738b167c8606", "value": "T18725FDEF4FD19B25485022EA9FCAF451B21C691FC2840BDEB54CAB91852BE3CF6D14B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438491, "uuid": "b360fef9-8694-40a6-9419-22e1ba3ccf83", "value": "768:di9ZL7pUp7D3hwLLhUvgUd/3lPFJFlZhipolNjxF7poLhoL7xdD33JF7j/hw7pCC:8F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786438491, "uuid": "c0f73692-bd96-440a-b287-7c34427b680d", "value": 981925, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786438491, "uuid": "b3f4c5b4-62c9-48a4-9dd0-0e94b8a35179", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438491, "uuid": "4be89286-35aa-47b6-9d5b-5b4c424a4bbf", "value": "PO25001898.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "190071e8-958e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786457296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457296, "uuid": "1a9bae67-0faa-46d1-9d77-30d9f1f7ad21", "comment": "Malware payload (Mirai)", "value": "f52a8e4915828815a8866282a8ac131c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457296, "uuid": "2a7bd08e-913e-422b-88c5-452d45f32842", "comment": "Malware payload (Mirai)", "value": "1fa5fa389116f6f7686105e92db15e9b993a8464d5c6651e21215bb43fb5120d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457296, "uuid": "fd23940a-4f7c-447b-9865-fbaf8f0b50aa", "comment": "Malware payload (Mirai)", "value": "057cf15fcf935fd06ccb302122e981045761a1f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457296, "uuid": "f21af999-dd3d-4ad5-9b1c-57ab1d77edc3", "comment": "Malware payload (Mirai)", "value": "bc7cbdb0babdb1150613769b55444f74eda9553d502d5bf7d25c07d88a47bab87a265c3101c7f378aedaf6187d197170", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457296, "uuid": "72f5727b-56b6-42fe-97d7-b61236acd69a", "value": "T131943903A5D084BEC4C6C1744F9F922B9662B48E2138FB5F37DABF522D26E605B1DB41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457296, "uuid": "b2d78515-56c4-4753-8f9e-fed38bed1f0b", "value": "6144:PMJTY6hMgrobuQwv68FdX4ZzZOfII6QcK0OZogFCwM1hiqUdC56M3LAibB5WKEI:PMJXhBLQbZwogsBjUdC5j3b1oKE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786457296, "uuid": "0c4f1436-2f06-4563-a2be-e1fd63e1ba96", "value": 421616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786457296, "uuid": "fb0877b7-efb6-4b2f-94e4-5ad1e98c4bea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457296, "uuid": "f5b7b5b0-bfff-4284-9bfb-29e2ba58fd0e", "value": "sys64.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaec0382-95bd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786477727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477727, "uuid": "76dff4c0-b016-485e-9f9e-3781a889596a", "comment": "Malware payload", "value": "5139658ee7e0a55b8e787affba9fae1a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477727, "uuid": "6b1f8a97-30f8-433e-a86a-d9a96fad2967", "comment": "Malware payload", "value": "1ff9fc3b5964a1642acfd5001a35f65ec5eb70e5d1bf02b8bcd5289a1b61ae2d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477727, "uuid": "c0e5383f-ce15-4f50-9271-9d98954a2ccc", "comment": "Malware payload", "value": "d1f9c080e32a6740084de2db4a0146badcd4a896", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477727, "uuid": "8b7f1db1-e0db-4fbd-96fb-fb760a38f4bb", "comment": "Malware payload", "value": "e94719fae7e8c7c3fa22d0e8768cf3ce0e0539d979c9aae52875dbba1fbf9e3b1bfaffa8a049afec55e36f9b68314494", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786477727, "uuid": "9d3a24bd-118e-4cdd-8d53-3cec409b85ff", "value": "T1FA6384553303DA6FFCB907704AF28AB4A3D8B8D635B15697E72ABB4C0F310996D085C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786477727, "uuid": "c787f40a-0405-4dc9-969a-ab2d1afd18d2", "value": "1536:ZzBwmvqX0nXM6VwfXUzt70Fx/NoGv1YB4ou93jpkzbTTbftKwemp5KGgvLK5eKJQ:ZzBL40R4jNeTbXYr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786477727, "uuid": "7e347706-ad7b-4df7-bc92-8d6c2206fa1b", "value": 68104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786477727, "uuid": "e068a2b2-bd2c-427f-b233-17567f2994e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786477727, "uuid": "3e7db3ef-f991-4aaf-a537-6eb82fe3afe2", "value": "main.mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0a02c03-95c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786482031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786482031, "uuid": "12865435-3191-4918-b77e-a3977fab832b", "comment": "Malware payload (Vidar)", "value": "b2e4d2fdb568d708e2fede4962e208e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786482031, "uuid": "71cc5843-952c-4454-8e99-45d65c202893", "comment": "Malware payload (Vidar)", "value": "214a74e2a64c24907c95f23a6d6875c95164ffa9752f35c31f2d132febfa811d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786482031, "uuid": "0f9667de-aaf8-4090-b0fc-4a3a4b2fee23", "comment": "Malware payload (Vidar)", "value": "7b1b1395bf410e9b45cea2cf005a67894a18fa90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786482031, "uuid": "4dd97f4c-1461-467c-8918-fa95934adaed", "comment": "Malware payload (Vidar)", "value": "4c6c17635b082b5ff4204e760a598bf1149648052c2eb73434f71dbe47e38ae177d28ebf93e34d5fda86772cdf5a5dbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786482031, "uuid": "ed455157-7383-4cc5-941e-83e3d2fdfd9e", "value": "T1DF069D07ECA049F6C099A33289B78556BB35BC491B3633EB2E907B782E723D01D35B55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786482031, "uuid": "c5514c03-020f-44fe-ad58-8001af687b3a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786482031, "uuid": "78e999ec-bf77-46d5-b97c-06ba4777d4c3", "value": "49152:ABSixeKxsnz/blA+h8y0APBmETys0+TIqJ0mIKmEmn89Y3JTru0v:Ab8bfTy1+KmvmEfY3xu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786482031, "uuid": "0263919b-6c04-4005-9fc3-17ac3bf1bf9c", "value": 3784024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786482031, "uuid": "79b77c30-0fea-4d92-bfe9-ee23bee3fdbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786482031, "uuid": "847d7547-8b9c-45d2-b5cb-de7103ad069d", "value": "214a74e2a64c24907c95f23a6d6875c95164ffa9752f35c31f2d132febfa811d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d4210fb-9579-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786448498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448498, "uuid": "22ee5d84-8c68-48ea-ab68-bb18dec8fa87", "comment": "Malware payload (Vidar)", "value": "02120281a374a79ca6b7a3876042f023", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448498, "uuid": "0c863d73-75bd-4a13-b0fc-a8302b88f354", "comment": "Malware payload (Vidar)", "value": "21c95c9c45231683e16f41873b7a44500148769ab580bbd6b29d1345d999ea70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448498, "uuid": "ce5c9f52-4174-48f5-b044-1cd5c24326ae", "comment": "Malware payload (Vidar)", "value": "bf02d6875e9a90f1355fd65569351fef7b8fb9f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448498, "uuid": "0bd5ad24-1199-4b99-8385-b3a0c28180fa", "comment": "Malware payload (Vidar)", "value": "20daa499505c7d24e4ce4ab71b19fe47edad9d4e70a627f7c769d777b9804bf0b482fc171007a72f71920a563d651cbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448498, "uuid": "c5486c93-a0d5-48f9-af33-ac77f4a84df5", "value": "T149D58D0F6CF449EDD49A96358AE64262BF71BC850F3537CB1A8172381F72AE0AD39354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448498, "uuid": "1e413c10-9c41-4fa8-9c43-e49d8a46a873", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448498, "uuid": "4a1e24da-e7ab-4a34-9455-2790625465a9", "value": "49152:6f2kaDpQ2aTcDbsX5IXDvzdqUT09YACZnN:6M+UbHdqUTeSN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786448498, "uuid": "79a0c881-bee9-443c-8fc8-fa3eeee32a2c", "value": 2920856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786448498, "uuid": "7edbf628-dc39-4db5-b0ec-01c9d8701b3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448498, "uuid": "e6335998-46c8-4d63-af6f-66b0acf179e1", "value": "21c95c9c45231683e16f41873b7a44500148769ab580bbd6b29d1345d999ea70.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2c1bd26-9588-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786455057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786455057, "uuid": "5608c8b9-d685-4404-b56e-6403e577d45e", "comment": "Malware payload", "value": "c9c5f803c301d787ac9006e911175df9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786455057, "uuid": "1c14417b-14ee-43fb-b26a-437c49bb0c97", "comment": "Malware payload", "value": "222c7718542f318442cab6f7e5a07a8b593309bbfcf51b442b3a245e244be148", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786455057, "uuid": "87d0e67b-b7e2-466a-a9de-6754771f4d13", "comment": "Malware payload", "value": "4df889509468e5cbb2f7f2a8696b1a0d8f777859", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786455057, "uuid": "58830b06-6456-4602-a006-d343c15f4e5d", "comment": "Malware payload", "value": "e697f34611eb4a5c54f82afbd53fa0c3f36ccb7b38e6644a3bfad43df72455969acbf478c19f0143b0b2017dc848c4ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786455057, "uuid": "d1252e5d-80b5-4bd8-b467-c9dda07ea2aa", "value": "T1DB032AD3C52A9EB9D006F4B1A5F58E780713BC554B2B0D94A13ACBE0038BEC9F189776", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786455057, "uuid": "3fe7c0f7-c6ee-4f33-be9e-f2b5eb9efa4d", "value": "384:rDScUk+2XivpmlXaARI/qgj+DFjgLhqK2HfQT2+2/Tb4LT5uiHygCYStwsYRpmnE:bC2JVRpgEeLh0HxiHyoSmsIE5R/7os4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786455057, "uuid": "86600c66-30f0-4e14-aa8e-0296bb9d3444", "value": 40800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786455057, "uuid": "a35945e6-db3c-4196-ad1b-74fcec7be488", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786455057, "uuid": "439a3f97-0342-494e-b5d6-3aac7d2de04a", "value": "main.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49c88398-95b5-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1786474128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786474128, "uuid": "ff5f5172-8a3e-4cd0-ad2c-4c75bfe7256e", "comment": "Malware payload (CoinMiner)", "value": "e19d21be0c143f200625fa1af08782bc", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786474128, "uuid": "760d326d-20f5-4b37-a600-11714dc74a8f", "comment": "Malware payload (CoinMiner)", "value": "22630f34330fd5259344e237f3c977f7dd9f23047cf2bb866adff661f9eea5fd", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786474128, "uuid": "5c647942-fa3a-43f8-98db-53a140cab927", "comment": "Malware payload (CoinMiner)", "value": "15707e688ddbcc96df5a1941bf08312937e5dd29", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786474128, "uuid": "2b1ec7c4-5813-4947-9c5c-f68b1207a0da", "comment": "Malware payload (CoinMiner)", "value": "f35507fcbac1397859190b18e0b31915765aa91d531dff7a46472ebc0331e1e658eceb5b16559aaf5c5cbb82eb732095", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786474128, "uuid": "feb017b5-f1ce-49b0-805f-3bd40096658d", "value": "T1A1363353BCCA653AC476C3F51296206EB23C37E65E607C4B7ACD55068E8AD0A343EBD1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786474128, "uuid": "39593f64-4202-4cc1-9e4a-e308e7a4126a", "value": "35171f6f6a1bfee47cbc04cb345c411f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786474128, "uuid": "09a79b0b-b31c-400f-8507-08c6dff98b75", "value": "98304:I9zm42ATYm8AWNSkGo+V8jwTNyBWBc2YfrKmuimxHVxEt4r7StcF6:I9zm45sm8AWICAJK2Y+mGDfXKq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786474128, "uuid": "6a00ec00-621b-4fe4-b1ec-c3d39b085e75", "value": 5217280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786474128, "uuid": "8e0b8cec-7827-4672-95b1-a00cc5ddbd60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786474128, "uuid": "4dae58d3-9148-4780-b0d2-e48a9ad0e1b3", "value": "22630f34330fd5259344e237f3c977f7dd9f23047cf2bb866adff661f9eea5fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4940359f-9523-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786411421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786411421, "uuid": "59f80f07-f737-48cd-b87a-b592867ff172", "comment": "Malware payload", "value": "e7f4c286d7c48af7b9a7500e5fc27f63", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786411421, "uuid": "7f2ad1cb-d1f1-408f-b242-33c41075289d", "comment": "Malware payload", "value": "236c34fca99a0818058bb2074dfe2d0d6e10c6bb517e6a08c4fedc27c6be805b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786411421, "uuid": "40e61e83-0ab7-4dc9-99db-93636af97115", "comment": "Malware payload", "value": "186a2bbf1aae8e498062d7f1e64d6864e39bf39e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786411421, "uuid": "f1bd1b23-4bdf-4736-9537-6b9e9e3b75fd", "comment": "Malware payload", "value": "5843414f49e474d288f409150ad4f52516cfd070fac2d57bb83ba9f59c2da923580dec7d9af92c87712d09861d837861", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786411421, "uuid": "6ffdff63-a2f8-47de-99e3-60a842eaea37", "value": "T174055D12FF4C6417C70A06B1A56E5B7CFB52B45381F5C6033B0866AF64D233A1DABE89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786411421, "uuid": "43464d57-4433-440b-b1e4-f202e83c5cf7", "value": "24576:mBZivNMk3fSTENarbX+u7YtTIoFiKd/obu+ue1P+2pKrxw2UABcb1e:mBHk3fSTENarbX+u7YtTIoLiu+ue1G2e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786411421, "uuid": "83af03da-6486-4aa7-8522-b4b4c5377af2", "value": 860392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786411421, "uuid": "7dfb73a6-f165-40a4-813b-38b2992d62ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786411421, "uuid": "d63fe75d-7fa8-45f6-9536-f5e749748b9e", "value": "main.e5500", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e2a3295-95bb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786476632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476632, "uuid": "104bab4f-4e5b-4f53-b990-050ea92a0668", "comment": "Malware payload", "value": "26aea0bb414e60ea92158e08a6e4249c", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "unattributed", "colour": "#1869C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476632, "uuid": "7c11e8c6-ce9c-42d4-bf60-e8627531c510", "comment": "Malware payload", "value": "23ce653f7c183985d427dd26298b15361a812e1aab905d7ecbad46ab42ea7433", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "unattributed", "colour": "#1869C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476632, "uuid": "4588c34b-ebe9-4fe9-aea1-51ee77d882b2", "comment": "Malware payload", "value": "b82080154e7415ac377952300ef9764407f6f9c4", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "unattributed", "colour": "#1869C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476632, "uuid": "acf0f1ab-7e56-4545-bca8-ff1e0674896c", "comment": "Malware payload", "value": "54406c5ad048fd4815fd60d06ce987446bcd9f932b17cf2c07652cc2d7f7e4d9c57025afea954bd54157ec7c22a92374", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "unattributed", "colour": "#1869C5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476632, "uuid": "84280a04-17ea-4d68-9f05-2e1855ade593", "value": "T14256338AA58380A1D82636B08503D4FF763F34C78F45CED7D8D55D8DACA2ED9353258A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476632, "uuid": "cf7497fa-fd9d-47e2-9545-520f00d252dc", "value": "d4b45184672816eb7e23441f846a3e1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476632, "uuid": "d12e4b7f-e92f-4097-963a-bcb588315307", "value": "98304:zBj1A8gxIe6xjonuXuJSOYjcKJnTTLj/s1ZgyU89LEuWUYbnFp:2xIey8xJOjNJnTTE1/U2ExnFp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786476632, "uuid": "9ea6fffd-550a-42fe-af2a-ae04d1078af0", "value": 6145024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786476632, "uuid": "8de0c895-d8f9-4c44-849d-20fd97f55441", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476632, "uuid": "772e2b2b-525c-4983-b7bb-a79a6d26978a", "value": "23ce653f7c183985d427dd26298b15361a812e1aab905d7ecbad46ab42ea7433.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35db43cf-9529-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786413965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786413965, "uuid": "ce9ff0dc-45e9-4d77-b40e-f3cd598c71e1", "comment": "Malware payload", "value": "43eb8bf498bf25275a4552a8691db450", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786413965, "uuid": "27f291ab-29d9-4073-b8e5-5c1d96f38d4f", "comment": "Malware payload", "value": "23f0eb8fdcbb3953d5fb11638e90f02fe479a41280366d06ff2f74c4d91286fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786413965, "uuid": "7e39f697-2814-46b2-aefb-0946dc3e6bc5", "comment": "Malware payload", "value": "238742db28c333d9f0c4ceb5b8b24a965ba9fe7d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786413965, "uuid": "0251cee0-b174-4be1-8c7a-de179b85a9b1", "comment": "Malware payload", "value": "6c2c0a19bfd5cb94660a2b54bcf79372fd10b5140f4b7524530b7c11fa9a874d29839333547c972d9789e18479890c8f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786413965, "uuid": "963bbdb6-8a0c-46f7-a58b-eaa50f25e103", "value": "T1E453D71BB6A3B0BCC287C0B45A9BD5B1B93178B402213D7FA6C8FA312D35D512659F72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786413965, "uuid": "ded2a306-540d-44e4-a41b-2d9fba262c97", "value": "1536:dlenMAMMAOuyp7Kqzo2wQXpvRqARuOyrCkUrg:fmMMA8p7Kqlqwbg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786413965, "uuid": "5e9d00be-f989-406a-b802-da76670f9634", "value": 66640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786413965, "uuid": "7e07c303-dc7e-4465-8e38-416ec6a2d297", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786413965, "uuid": "463f5ca9-6d88-4516-9624-25336b0ce6dd", "value": "main.x86-64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c77f642a-956a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786442127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442127, "uuid": "19d5c581-69f1-4ece-9eec-44c1745cec69", "comment": "Malware payload", "value": "4ab9024831a3c786ba3b5e98474dcc2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442127, "uuid": "3739dac0-ccd2-4b68-a4e2-316df7b29eb8", "comment": "Malware payload", "value": "243c5a1cb8cead1aa028d7470e63fa33b313ad6434c57b249008daba43c0f71f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442127, "uuid": "f8802fc6-ca4b-4115-a323-8bc887d6503f", "comment": "Malware payload", "value": "07d3110dac6559428e99192d2d06fe64d4ea20ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442127, "uuid": "072761b6-343d-4842-816b-b1ac88eb72e6", "comment": "Malware payload", "value": "810bf4fe6825b22c731911eeb5b643ef26294409ae75ce4c8f65003fbee6513ac21efa8406a6b3a63534a9896e19223a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786442127, "uuid": "71c3ad42-7244-4f35-9cd5-2f99890ca75a", "value": "T15E365B22959017ECE07FC179898A5E12FB317009136567EF09D045A3AEA7AF0BE7F352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786442127, "uuid": "8eb441e0-7756-4730-a154-1167948ae875", "value": "c86ff6e3967f467999f37a6ea7443c31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786442127, "uuid": "9456384d-ebae-4475-bd49-3de699246f07", "value": "98304:BVLnrOHTVjkcMUgohT3higkVgohT3higk:TLnrOHT5q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786442127, "uuid": "9ad123ce-d63f-4e20-8f16-b1c237f6b88c", "value": 5125632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786442127, "uuid": "d9cc3219-252d-406a-81d8-6aa2922314a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786442127, "uuid": "b9c4f314-d52d-4b1f-9f2e-872120ec0361", "value": "update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9f0231e-9523-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786411610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786411610, "uuid": "4272981b-8e3f-4653-906c-a9ab0b390933", "comment": "Malware payload", "value": "d2acba492dd58751cd01a851dae6cdff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786411610, "uuid": "71e51499-551e-4c67-b004-b3da12ea94c3", "comment": "Malware payload", "value": "24cee19d2763a412eb4bf710986acd1373a4754729986f4101913da9e0da4bbc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786411610, "uuid": "7bdb9b85-9565-45c6-b02b-7a3173690622", "comment": "Malware payload", "value": "43352be354db309f97858e87988007b909f1dfe5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786411610, "uuid": "5547a504-d161-4311-9561-5100d01727d8", "comment": "Malware payload", "value": "f031ad91573e0417bbb33a1a39e33d7d9d74bc81253810c11c78f635f7d37111baeea89cb2329540e59799110905fbbf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786411610, "uuid": "b2424090-8ab6-4aae-b324-8da8bb5c4a2b", "value": "T18213D913EE65C02FC48BD1B05BDFD6359A23B87A0736A006A7A0FF615E45980DEB52D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786411610, "uuid": "fb62cce0-f0ed-48cd-a1bc-7ec8f4b4e60b", "value": "768:JRa/4bV1PzRy6k+FuhJb6mZeaxSgRX1A8cHpQ/0XkwKJt:ja8V1PzQX/fGmZjdX1Gp8wKJt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786411610, "uuid": "254ec02c-0e6f-444b-95a5-629be893e895", "value": 44512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786411610, "uuid": "786fde73-ddba-4e22-b7a9-8ca8594440ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786411610, "uuid": "fab288ac-4dd8-4344-9754-cd5cdce11f61", "value": "main.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6ae2fa2-9562-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786438716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438716, "uuid": "cb11448b-8480-40d1-9666-0c5f119922f5", "comment": "Malware payload", "value": "62a7a40af83373d18ec1a9d11c0dca8d", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438716, "uuid": "c40265f9-702d-40d7-bd12-e54a99621d06", "comment": "Malware payload", "value": "2504e08f98ff2be019532effd12ebed01935bcdfa0dde7122accd3946390d402", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438716, "uuid": "c5a42336-95af-457a-b8d6-67c577a90f34", "comment": "Malware payload", "value": "adab35eac17811549ab2c491ad3bf70dcccf139d", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438716, "uuid": "44789d99-3ff0-4f75-b09b-d2601ffaf9b8", "comment": "Malware payload", "value": "acbdb1a45ba6b19832c6f4e100b7bdbc0631cf9c1de45b4bead7999ad6dbd71bcd9ce9ba627341e50df5ad7d65e0f19c", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438716, "uuid": "b85f4165-8e21-41c5-82bf-97846723c764", "value": "T1EBC7A0B3EF3530C9AFF651EF6E0B84945A79388845E644CA7E07D9E3905A4290377CB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438716, "uuid": "6425e09b-c57c-4002-8b06-a12adeed665c", "value": "3072:mzbuzbqzbHhXzbqzbqzb2zbbhuzbqzbbhGzbDh7zbozbuzbDhdhczbbhIzbbhhhF:oB1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786438716, "uuid": "b50aef06-1869-40cb-b188-0a9d4013c8f8", "value": 53338845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786438716, "uuid": "da96985c-a082-4a93-b70c-1218171ee9cb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438716, "uuid": "60980c1f-963d-4b8e-835c-b0d0222a237a", "value": "\u00d6DEME.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61c54036-95cc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786484047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786484047, "uuid": "83143395-88dc-4b25-9e4f-cfbad91f9775", "comment": "Malware payload", "value": "c42a52b56ddd10cfa2b71f9425dc1b60", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786484047, "uuid": "8cd9812c-0636-42bf-b227-1abfd2b1b00d", "comment": "Malware payload", "value": "258442a791d2e93e78aaaeb9d1faa384b894ee216e73fd1669d4bc73fa2518bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786484047, "uuid": "08e8dc62-a97f-490b-95e7-049bff01377f", "comment": "Malware payload", "value": "e7c83e9ec99d57135625b361331d0b341a3c8cbd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786484047, "uuid": "228d645a-e27b-48e1-8074-7a15ec65bb6a", "comment": "Malware payload", "value": "da8ba02d824c980e1e71fc5c607168e546a828880ab927261e1a83f2ac94951f0567c0c50f0b273f23fad228a7c3ad7d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786484047, "uuid": "a7f84f2c-2865-4669-86df-02d0b86845e6", "value": "T13CA32A4B660775C0F57001F4A7CE4BD13F2260DB6B3A5EB6AC6912F3ABB319A181C652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786484047, "uuid": "39f777c8-d943-42d0-b647-6e43e8f4b50f", "value": "1536:vH5q26bctMJchdKtQYJkxDZT6PbRGrKgqaeUn5p5M/LWJ:vH5q2ccW+LKtQskx1g2KgKhqJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786484047, "uuid": "c24107ca-c9de-441b-b96a-a3c60a7f223f", "value": 99808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786484047, "uuid": "eb6b188b-c65e-46b9-ae86-95b18f27334a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786484047, "uuid": "9ec932a9-6dc3-49fe-ab6a-eef266cd9356", "value": "main.arc700", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1afc7571-9595-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786460306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786460306, "uuid": "6c53cecd-9ba0-4f1f-af98-15f7f1f457d4", "comment": "Malware payload (Mirai)", "value": "a80c7f0451724cf7b2b082930121e68e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786460306, "uuid": "7d2b9b97-49a6-4798-893a-6731d39786a8", "comment": "Malware payload (Mirai)", "value": "25b4bea94394c6883329072aa00a97408f75371e4ead2017d8d98ad37dc0d474", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786460306, "uuid": "9f41fffa-118b-4836-b118-2c50f9d518d7", "comment": "Malware payload (Mirai)", "value": "5f88b86d3533ab27f8e8f8a54345a34c52e5159a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786460306, "uuid": "0535d43b-9400-4d0c-90ce-fd0e0e1ebe6b", "comment": "Malware payload (Mirai)", "value": "4b2c566ed673a158d13e73b8ba6b0b90a49e48711f0bd8bf8ffbd6bb29f9a6cca3b739bb5da0fed1981c084d1361904f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786460306, "uuid": "38cf9b33-2c64-4794-93ae-176560d4e33a", "value": "T192630255CE614C13597A2879C9104F8CEB117A60F1A93574020E76BFAEF2D92CDABE81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786460306, "uuid": "29cd85f3-f9c6-4917-86b3-9a73e645987c", "value": "1536:oHgQhaZe1+NfcldqkT+yDhJuKSpUewqIb+OlksoR7aC35Xlkfy+DLC:oAQhaZNmldRuKUUewqQ9NZC35CDLC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786460306, "uuid": "9ad24109-eeb4-4513-99ef-94f86c4eeafc", "value": 70464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786460306, "uuid": "947a6130-2cd6-4097-bd8d-d302e71f42a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786460306, "uuid": "f71cc5a9-b40a-4439-b593-cd540c24824a", "value": "sdfjgnjsdf.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baf52e96-95c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786482049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786482049, "uuid": "d291e5e7-bf00-4d04-a3dd-c7a1c6437464", "comment": "Malware payload (Vidar)", "value": "aab55ca1180ef4bb175ec0bb5b2eb41f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786482049, "uuid": "831de7b9-9026-422f-9c71-a7aeac88572e", "comment": "Malware payload (Vidar)", "value": "25fb430475571f33d8382cfe81b60bf82fbbc45555614440ce0dafb43f6208be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786482049, "uuid": "4d1c47bf-9c45-4dc8-93c5-f1de1aeaced2", "comment": "Malware payload (Vidar)", "value": "07eabada2109add9eee98c87415fbd253480694d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786482049, "uuid": "62298464-751b-4091-8557-239633c1eb21", "comment": "Malware payload (Vidar)", "value": "c44f37332833e55c9ce906241f7b6818e50fd4c103fe60d53cfcfa9b4a9c23dd3dd603472f833f9bc7ee850d16fa497c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786482049, "uuid": "4dbad6a9-6941-4288-b7ca-c44761a32b6a", "value": "T1F5267B43BC9148FAC0E5A73188B75256BB75BC0C1B3523D32E60AAB82F767D15E32B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786482049, "uuid": "8a24913c-6075-4526-b2ec-32fff8876073", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786482049, "uuid": "678911bf-00af-4732-a47d-2fcfa78d6f5a", "value": "49152:6iQ9QQfW/qlt302zpPpzn7ZM2T65bRWBudz7KbUGsV76Rc54:6Nn30aByA6HWBudz7KbviW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786482049, "uuid": "2aa57ac3-6466-429a-a54a-78381158b9cc", "value": 4526976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786482049, "uuid": "74c987d7-90c7-486e-8a5d-b7c33d80ca43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786482049, "uuid": "1a1fb881-4226-4424-a00d-2da335cb7b2c", "value": "25fb430475571f33d8382cfe81b60bf82fbbc45555614440ce0dafb43f6208be.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07b85e27-958e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786457267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457267, "uuid": "21f90864-1914-4ee7-aad0-73893a0b4d03", "comment": "Malware payload", "value": "b70321b61272b2a45f9b19030b7b0305", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457267, "uuid": "48fde88f-33b8-419d-9c6b-b0f1e93627c5", "comment": "Malware payload", "value": "260064eb5bb63b69c75fb780bb6390c3beab7cd882bd06d6b0ad738993a47f8b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457267, "uuid": "5ff1d88f-4c30-45b9-9f7d-4f5eaec1702a", "comment": "Malware payload", "value": "22070a461a9f20ced32ba1574c0365b92d1b9564", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457267, "uuid": "81cf1005-a384-4059-bba4-76c998c85586", "comment": "Malware payload", "value": "1a9349afccb99bf7a6127937cf741702538e42ef00f0995b2a33caa31efc1085c92382a3ef8ebc8f92a0ce9ce0489c06", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457267, "uuid": "b959c8ac-e175-497b-93f2-7372c41aacaa", "value": "T1C64129CA10458A392CF29E6E71FA8858F3A1A0B720D59F86D4FB35F7404DE541D82EDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457267, "uuid": "cd297757-e128-4f40-87fc-a7ff1e57d40e", "value": "48:v0djqP0sM9VP0hdhjuP0hvyP0CGZP01rsP0Yg/P0c8pP0v5eP0DVEP0SW5P0gY1I:v0djqP0sM9VP0rNuP0hvyP0CGZP01rse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786457267, "uuid": "819e924a-53dd-42f7-970e-0e2ce610c543", "value": 2347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786457267, "uuid": "8213d3d0-64a5-4677-adec-5c40939ef3d4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457267, "uuid": "ff0bf0ed-6242-4bca-b72c-4ebc33c8cb46", "value": "zte", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dc06ada-9588-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786454807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786454807, "uuid": "73b234dd-ba97-44df-b73d-e1a76035bc60", "comment": "Malware payload (Mirai)", "value": "c00a2b969c09eed370723f4a736f7e32", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786454807, "uuid": "da6f0006-7ff6-4591-bfea-3b0cfafcc32a", "comment": "Malware payload (Mirai)", "value": "264ab9e0818f97df28fa8fedab86deeda62c60bf1c2f670d5f4504b2e2fba107", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786454807, "uuid": "3b572ee7-5ca3-45a3-ad24-cee1eee8b95b", "comment": "Malware payload (Mirai)", "value": "5a98fba3af359973f2d813465fb84d2fcd49d19f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786454807, "uuid": "3fd66907-2c12-4c02-9665-c8d14b2a273a", "comment": "Malware payload (Mirai)", "value": "57ec8bef2dfea24a058bb6494c8e1488c94e86c4d3e40d113d6cd0a44ebbb20869dee449dee34767d2721f9f2f4d7c8d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786454807, "uuid": "9428a499-20d0-4ff7-b875-b13be28ec729", "value": "T17E141956F8819B15C5D511BEFE0E528D33232BBCE2DE7212AD246F3077CA96B0A3B505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786454807, "uuid": "9838acd7-27fc-40fe-aab8-2e9d08d4233b", "value": "3072:mrEDLznyoiOI06jhhUCT+XyX3mO5NanV+BXMFV47Jk/vhCyQmdvz:dXnyX26dhB2yX2OTaV+BXk6JkRDQmh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786454807, "uuid": "c2fc0720-2602-4a9c-b0f7-5313dba6227a", "value": 195420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786454807, "uuid": "78d998f0-a8a4-4393-9c41-4c36ae34d554", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786454807, "uuid": "d602f62b-cd01-4b5d-a38b-047ea20cf5aa", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7153a822-952a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786414494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786414494, "uuid": "add24b07-74c3-46dc-b5d2-9489ce0c55bb", "comment": "Malware payload", "value": "f06afaac54140c6ab72a4ef825892cb3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786414494, "uuid": "0f6947bb-8629-42ef-91ac-4288bbb807e2", "comment": "Malware payload", "value": "2659d55e43243fc981db78cf99dff1a7d06f08e056ae17c3b49f0dccb39eb02b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786414494, "uuid": "761727f3-e7ed-42fd-b674-3c7989b9eea6", "comment": "Malware payload", "value": "600733ca6ea08a812f5bdb8f6d5e5020a6209406", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786414494, "uuid": "cc93a598-baa4-40e9-88bd-7326d668ae85", "comment": "Malware payload", "value": "fae84d8e3bb644a5c27904d60e3de2f4394403172620695038324e89cb73abe52c4fa756dbbb2cdbcb13b7cdd9dbd131", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786414494, "uuid": "f4f57800-7149-4a15-b5bc-a49a66153df4", "value": "T1BB636DA5ED0E7941E2D5E335EB594BE1A12F3CB0C35684B37A02B18DC4EDADD8ED2205", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786414494, "uuid": "576efbd5-dd4e-45ef-a5e1-850551cef00a", "value": "1536:I+KBN+6fktAudQiufMuZScIaQGjJDHUrOu:CJkyEQbEuZScIaQuDcO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786414494, "uuid": "ceb71bf3-123f-472e-b580-8a6ce8ce800b", "value": 70720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786414494, "uuid": "ca19100d-78b9-4a51-9c57-cb333c38e26a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786414494, "uuid": "99b5d9ab-5a95-452e-b6d6-75c90d1b92f5", "value": "main.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1428710-95bc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786477389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477389, "uuid": "e88cca2c-00d6-4c13-9875-5789045ac639", "comment": "Malware payload", "value": "5a54d3ebb186a7dd8926f48777205d82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477389, "uuid": "046f19a7-d504-4bef-a24e-3b8956ea03af", "comment": "Malware payload", "value": "2659e08bc43362af221f1e5759e0303a4d988eea6539b317252808a919b68877", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477389, "uuid": "28781ea0-406e-40aa-834c-bcd9c2a3782b", "comment": "Malware payload", "value": "f84bc812cc8453c96245637ae923b3a65817e466", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477389, "uuid": "6d851f25-a9f4-47eb-83cd-f093d36fa4a6", "comment": "Malware payload", "value": "268e69ba49ebdbe641f5e5f08f5da73398d4233abde898f394007fd35880568f62d331204e1b9ea8fba8fc1a68caa630", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786477389, "uuid": "70ad04f3-c786-4170-8074-10a2cbb2d5f1", "value": "T1DB366B03EEA548F9D296D73588774242B764BC499B3533D32E60BA742F363D0AE79B40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786477389, "uuid": "964a9b12-d36a-46b1-96c4-d560ffc62b6e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786477389, "uuid": "6c5e5c0f-c168-4fa5-8a22-1af8083058bf", "value": "49152:uFKpz7i7FAlc03DCBGcm+a1h6TczyJPj4RRHrYvAaaT:uc3XND1aJrCOkT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786477389, "uuid": "3a001aba-312c-40d3-ae48-fa1fc6ee2288", "value": 5001901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786477389, "uuid": "6e0e28e2-2133-4e5d-8fb0-8cf0508701ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786477389, "uuid": "a05b2cbe-c6b3-4f03-a221-45f77c3eba2e", "value": "2659e08bc43362af221f1e5759e0303a4d988eea6539b317252808a919b68877.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "870acc42-956b-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786442448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442448, "uuid": "21095d38-ffdc-4458-a756-0bfa85b86ad2", "comment": "Malware payload (AgentTesla)", "value": "dcdc082ce14a646ca3c8e28c94b55f13", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442448, "uuid": "7745ac31-61db-4547-b89b-16d239d921e9", "comment": "Malware payload (AgentTesla)", "value": "26a6bcb49c3cdc40e369983ed7f2c1ff94bc1453d529892b2d682dd2738cc4d8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442448, "uuid": "34f9f5a0-945f-471c-be8f-b70dada4d262", "comment": "Malware payload (AgentTesla)", "value": "a9246acc63962901946e9cbf2ad8bb1906f0b384", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442448, "uuid": "875a2708-249e-401b-9bc7-227e15e11ff4", "comment": "Malware payload (AgentTesla)", "value": "6442b06a6cea6da1866206bf64e1a3f54d166e257dc75a17b1172384ee379682993aa9397e0a99bd79a1ec6429c49531", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786442448, "uuid": "c514d4a7-9c6e-4f36-80d7-83196b364984", "value": "T1FCE5AE401594EE82B67C1B18C40E6FF6CF158A1B5950EE0731BCB99FAB5CF04B7A8678", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786442448, "uuid": "ece94996-ee52-4775-9e0e-3a758f46e248", "value": "49152:26yhDfusxopVItunM6QY0vqhqzoKkgBxLyMTKpandv/I9Adl8DIsZC7IDF13m:cfXootun+Y0vmUoHgBxnTKpantI9K8kt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786442448, "uuid": "251781e2-7a02-4958-b8fe-4232fecf0d53", "value": 3052462, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786442448, "uuid": "fe4da8d6-4d5b-4e5c-a66b-14bc3ff40848", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786442448, "uuid": "2d4a32f4-bdef-4039-986b-4d888b427d0f", "value": "DHL_SHIPMENTS_NOTIFICATION_9952312_PDF.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ef00c35-95d0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786485706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786485706, "uuid": "bf8cc537-382c-4e59-addb-055e8751305a", "comment": "Malware payload (Vidar)", "value": "e60038d14e0541a917713d5fd81b6ead", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786485706, "uuid": "874b4890-cdf8-4d58-abd0-4a35af888053", "comment": "Malware payload (Vidar)", "value": "26ee67fb5756b14d0a6d2b30ae6bfc064390ecb753cf71746d8902ea379a7222", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786485706, "uuid": "74fdda6d-d1e7-4461-b431-95288e82c255", "comment": "Malware payload (Vidar)", "value": "c53896089e5259f82081d32cece7ccddbda3f16d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786485706, "uuid": "cbfce695-5ec0-43e6-8f22-5125b6032cb8", "comment": "Malware payload (Vidar)", "value": "5ee8c7182947f6627efc1ee662bf85ac53b49523dabd5e7f4672921426f2e9e0fb8fae24e26f8d9a2e3a172a098ae21b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786485706, "uuid": "92b16450-67e5-4ce7-9d4a-7674dc87d77e", "value": "T115267B03BE9548F5C095E73589B74252BA74BC4C8B3133E32E60AAB82F767C06D79B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786485706, "uuid": "c3e3b7e4-3735-43b6-a6d4-45ebad902f59", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786485706, "uuid": "02368718-bf31-4a01-b9d5-3f5d01659a79", "value": "49152:2ILcM3f5WLgxyVM3VtG03LpF4sQtcBQTRvzrKAgyk:2LFVM3jGCpantb9vvKyk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786485706, "uuid": "cab97c30-ad9d-4a0b-b0b3-35df26a509fe", "value": 4718960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786485706, "uuid": "f9e13a5e-faea-4133-a093-4e4ac52ade89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786485706, "uuid": "3ff8cdbc-061e-4890-840c-85a81ecbbb75", "value": "26ee67fb5756b14d0a6d2b30ae6bfc064390ecb753cf71746d8902ea379a7222.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9acd890b-9529-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786414134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786414134, "uuid": "f590d559-c027-42f0-9f97-b353c810a461", "comment": "Malware payload (Mirai)", "value": "9c749a399ecea3441a11e2ba755459d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786414134, "uuid": "8bdc2ca3-6a51-41bb-958b-d07c65b579d9", "comment": "Malware payload (Mirai)", "value": "27521c4e0452c798e790ce99c83c79e13ddcfab4833424e9fe8d3d83f42b6dbd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786414134, "uuid": "56904dbf-7b3f-449b-83f8-cb70b597aae7", "comment": "Malware payload (Mirai)", "value": "e788ff098aa88a9917d554425eee0a7b9ea334d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786414134, "uuid": "a30602cd-d5a0-4d4c-95c4-df148a5c5255", "comment": "Malware payload (Mirai)", "value": "85cf51f87a4ccffe12cea84381768754998bacc2a3b1cf9012c1a0d1b53ad12a43ec9bbbb3eebf08553fc6e9963c8be5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786414134, "uuid": "0d42b64a-7692-4d5d-8197-91c1a5e28e71", "value": "T17463027360464166DCE8E27C41A61BD17FBD2BB3174BB80FA1657C4B2DE6268329384E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786414134, "uuid": "7682b987-0dd6-410e-bacc-db61c7223484", "value": "1536:iGV83BPRH53W190JNQpUIDfbZnn4NzISgNDVJuK:iueBZ1W1OJWJfRn4eLVQK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786414134, "uuid": "1f6e463c-0178-4a7a-bb30-287c72649dd5", "value": 66864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786414134, "uuid": "9f916ff8-ae2e-4bca-baff-4418995aa633", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786414134, "uuid": "1898fe53-352c-487d-9943-ea4e18a6820e", "value": "sdfjgnjsdf.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5a6ab72-9550-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786430983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786430983, "uuid": "aa12a303-d1b9-4e8e-ad91-2c4f5e66ba05", "comment": "Malware payload (Vidar)", "value": "7d0cec5bc7530c5b564d379d6e2420bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786430983, "uuid": "87c2c0c7-ab19-4685-af45-4b1bb9614a2f", "comment": "Malware payload (Vidar)", "value": "2776235cc524a989622f6d2da0c2dc17c98f614794601e78b159988ede7ee4e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786430983, "uuid": "814978d1-b98a-486d-8123-4e46324800a8", "comment": "Malware payload (Vidar)", "value": "a6cf1d288df71eff310ce9c845b92b8dc0d02849", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786430983, "uuid": "27064212-8118-4a75-b7a7-623cbf6d62dc", "comment": "Malware payload (Vidar)", "value": "08e6cd9ea7edf677607700b74fdfbe2af3963f6289f2ea3ebaac518a2755113fe6e14f6c4654c5d72dae406bf73f30d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786430983, "uuid": "5b032b4c-310c-4777-a9d1-5cb4d5592f2d", "value": "T1D1F40999E5D113DDD873D636C308922AFDF83868BA30CAB5538219B45FA2F3475983C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786430983, "uuid": "4fa768ea-3642-4152-b451-5e4e507f5b35", "value": "12288:+zUf1/0DY3YUsdbXGinoMRp7hZzH9ZabDFzZkAl:Z/OYyb2in3hc5Z5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786430983, "uuid": "6f58d28a-0c17-4a1b-96e3-2d18033fa5df", "value": 777728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786430983, "uuid": "3f7e4199-f280-4c61-bf28-62f7fa694d27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786430983, "uuid": "cb198124-fee2-4396-9f21-835d65728a54", "value": "1ee36fe4ffa29be8504b9d0f7d3e47f0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e396e89-95bb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786476605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476605, "uuid": "8fef3e6f-d9f1-4107-a026-b0d10bdfe6ee", "comment": "Malware payload (Vidar)", "value": "e10518f69e0750cf947ce5fd4e5f62b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476605, "uuid": "bd301963-8187-45fe-b27b-e3c66c80c625", "comment": "Malware payload (Vidar)", "value": "2786dd06b463c3db2f767b10f77e32aabb811f61036f311c7f70e0397b7afff6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476605, "uuid": "e7a4cc10-2c7f-4e9f-93c7-90eacf12672a", "comment": "Malware payload (Vidar)", "value": "c673e422edc65234bcb5ef20a25894202f7a040d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476605, "uuid": "1150ce12-85c4-4fad-bd99-a1468e6af16a", "comment": "Malware payload (Vidar)", "value": "2e1007220b778a78dd173582d0a1d89d6e358bdc3644317b72cf7965087446870824c1b2e482b1efb930cf326f6cc5f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476605, "uuid": "922819fe-e64a-43df-b2d8-d140ac6eb2d4", "value": "T1AE264A03BEA108F9C0AAA73189A742567B74BC4C4B3133E32E50BA782F767D15E75B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476605, "uuid": "f166f607-863f-48bf-b152-a01c1268e453", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476605, "uuid": "e3a02f96-3f4e-489b-8cc5-2848ff7f9f27", "value": "49152:60J9GZ6uRsqEN8uK8FpofCmVZCrlMFcYQ3CcXEorwgszcm:6UGuD7ofrCOmxCcXEmq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786476605, "uuid": "8facc85d-7cd4-4bc3-9a51-ee47203692e2", "value": 4603752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786476605, "uuid": "6dc15107-4887-41cf-8748-aa4834ca50af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476605, "uuid": "cb931c34-efe8-436d-8ec0-5d7a3dc900df", "value": "2786dd06b463c3db2f767b10f77e32aabb811f61036f311c7f70e0397b7afff6.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c206e185-957b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786449419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786449419, "uuid": "fce32055-b650-4faf-adfc-08f8fda77e89", "comment": "Malware payload (Mirai)", "value": "d1073aef9247fd056a90d2a015d7568b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786449419, "uuid": "9afe1291-7e4b-4f9f-af1a-6e270c94dd6f", "comment": "Malware payload (Mirai)", "value": "27c03c19ae123a9a523d6046fd0ba83e847c67f998f075054edea0f0fc0e43d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786449419, "uuid": "9223a98f-7eb9-4969-b804-b652330ad813", "comment": "Malware payload (Mirai)", "value": "c8a40405ae9a71c90703af8d3879bedcff3de300", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786449419, "uuid": "eac6b51a-1fea-43c7-8a43-a5e8a4fa52a6", "comment": "Malware payload (Mirai)", "value": "b98f243dc35d4dbd60b19cf3b3c67a46a84adfdf640e2bf1dd3489c208ef2feaae0370b19746328a5b9bdc61f008cc01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786449419, "uuid": "0ac3b255-c4ee-4bb4-85d2-059f37cfc0de", "value": "T169767C99FD0E3841F3CAE27CDE4A97E1B62B75A0D32780F37E92524CC59A6D4C6B1520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786449419, "uuid": "c0f082f5-5dd1-4556-a665-96bca3b30507", "value": "98304:qB2FSpFA3Hvf+nMwX+CoM/Wdc5Gbz+2OqwbWiHP+yHqazWbY:DSGHvfpdQWdc5Gbz+2OqJUP+M/qb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786449419, "uuid": "bf07f401-333e-4ee0-96cb-0d0cd1eea5a3", "value": 7510911, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786449419, "uuid": "e1ce5877-9f74-4a99-b65b-1da3e95ff222", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786449419, "uuid": "54dfe9bb-15f2-4a08-b4ca-31a7fd7bdd9f", "value": "Error84", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dce4d315-9548-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786427560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786427560, "uuid": "a4f5398f-f97e-41ab-bcaa-7a7584513cf1", "comment": "Malware payload", "value": "09b0b40b3d3761c8807322a2e0ba9833", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786427560, "uuid": "333ada7f-a0fd-4046-8868-8191484c6a9e", "comment": "Malware payload", "value": "28978ae6d797eb43770c8bb173235427ed0a548560725de03c06c080420f80e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786427560, "uuid": "d98a528b-e806-4dec-84c6-f4f375570e33", "comment": "Malware payload", "value": "cd52974725eaa5002b310c0d206e0e4933eb5728", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786427560, "uuid": "b9807d0f-0650-4f76-b210-c151159bde57", "comment": "Malware payload", "value": "30e77652a36673a8b4269ab7f5fd7149325ab310ad07e95698e8794fb551cb9a1454f0ef4e54b7d6fecfc5bc524fad4c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786427560, "uuid": "3a75f874-85a5-444b-a0e7-551d460f7b28", "value": "T1C3E4238A6BFF39D6CEA22CE841F6CB0A46992FE214FACD1448B6519C03D5112C922F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786427560, "uuid": "2d3c843e-f110-412f-980c-543f90a271c0", "value": "12288:VoJw13Esa1dWMz3omHXwxWvDQB1F2tt78NpI1jSvvkmlkT0teHA78/kV/7UYu:VoG13EsScEPHXMWvDa1kt78govVlkTuW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786427560, "uuid": "cf0c450e-4ba1-4af1-8906-3a47ceb04275", "value": 691794, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786427560, "uuid": "702be7aa-377e-4266-ac48-4346fbe69803", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786427560, "uuid": "bde718b8-1c5b-4a5f-b067-97c98e388472", "value": "pty10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11c9ff27-9552-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786431514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786431514, "uuid": "72cfc37e-6d59-431d-b524-a7c84685e1d3", "comment": "Malware payload", "value": "cbf2a5a4df7f634d3b6a724a8684f9fe", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786431514, "uuid": "af84fd47-5cd4-4fab-a358-930c7454a73a", "comment": "Malware payload", "value": "28cdbc777417bae08eeca94daed1e9e959956964f1844b3cab83de67aac7e2de", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786431514, "uuid": "7da85e98-b8bd-4ab6-af6c-0992e06ab788", "comment": "Malware payload", "value": "6a8c8ddf12c58d46c438f169f5c9d6018b0cb38b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786431514, "uuid": "f331f7bb-ef80-4f60-a869-0753bf49a596", "comment": "Malware payload", "value": "a77e718e93f12fdb8ac2d9d7f03dcb8402caef7ac7917971cb5d9702e8630eecf97cf7823c77943bc0afd4c2f5a3964c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786431514, "uuid": "884370f2-de54-481f-83e9-93961aad4aa3", "value": "T12A236C651A857C24AA98D4371D7E2F0CBDAD43E6320492DE7FCA3CF28C5A69DD10872D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786431514, "uuid": "cf335a0d-5ac9-43ef-bb8e-e88334e6fc1d", "value": "768:GXRWNGxVy9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:ilxdcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786431514, "uuid": "643eb1bc-f469-4438-8068-812aaf02b8a1", "value": 50071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786431514, "uuid": "a9fe0d45-a81d-4867-9b22-c0c3ca0f5f31", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786431514, "uuid": "081f97ff-d416-487f-b229-1918d2ffb5ef", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa09011b-956c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786442936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442936, "uuid": "98b6c241-29cd-4b0e-99bd-cd129a76990d", "comment": "Malware payload", "value": "3be0509f40d152911a36a36aaaaa7e21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442936, "uuid": "e2dd0ffe-1349-480c-93e9-0133fcacb298", "comment": "Malware payload", "value": "28f83470b477e89081c08772af0470c6e841cc01c6bef4472f3b8eed47f852ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442936, "uuid": "5ce89ccb-78cb-4599-9695-f8abe0fdce79", "comment": "Malware payload", "value": "b6e6fdcd1c0aad0c22ed43d123a625d2a8fcdbbe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442936, "uuid": "e9bf8cb0-38f6-4bef-9ef3-a9b0ae973bac", "comment": "Malware payload", "value": "14c657450efbe6ea5904d7d2035e1913a033730df4cda60764fb7d1bac18146162a92b65863df9b3161d3f48af1ff8ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786442936, "uuid": "521822c2-cc53-463f-bac1-875997408869", "value": "T1B663290AB35364FCC42AC1B442EBA737EA73F86606316F7F5364D2312E24D906E2DA15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786442936, "uuid": "6d2eea85-1ed1-4637-aecf-d28cd2d24561", "value": "91d8be4f49246c5818d6b02af88b4166", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786442936, "uuid": "08a2337e-6014-45a3-86e7-030705375665", "value": "1536:uRbPvnj4oJLe9AeEgvGRP38HjbmJhEbWg6Hg6IW:uRLnaFHnmwcxH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786442936, "uuid": "d528b2c3-c707-4c55-9bf6-3b6c74de08a6", "value": 69120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786442936, "uuid": "6e2e40ac-ebad-42c5-bbb2-08621dd9dff6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786442936, "uuid": "7bd4be24-1c88-488c-9933-dd65e0953747", "value": "28f83470b477e89081c08772af0470c6e841cc01c6bef4472f3b8eed47f852ce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3578f06-958d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786457152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457152, "uuid": "e8e8b65a-d80b-48c4-a587-d2b187f744df", "comment": "Malware payload (Formbook)", "value": "b0fbd3ce8be0097704c988b4fb5de0c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457152, "uuid": "a6ce4849-0b4b-46f8-8fba-ec6664911b7d", "comment": "Malware payload (Formbook)", "value": "28ffd6cabaa73b275acb5f6e12101bae89530dd730e6bc414849d80b5c206875", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457152, "uuid": "cf15903a-a8c2-4449-847b-180239a71242", "comment": "Malware payload (Formbook)", "value": "23162c3088bdce72e85137d9818602b31b2c2df2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457152, "uuid": "41590575-c53f-401b-906a-6cda361c87ac", "comment": "Malware payload (Formbook)", "value": "fad50b457b61354e7689348e7409f120330b2d911f2d1558aabae488f52be2e2c08c9b5194b0aae80a77b2320b6e3e13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457152, "uuid": "c3d054c9-ad0f-425c-b848-52a27efb1a9c", "value": "T17E3501582229DF06D9634BF00930E7B517F96D94B921E3079EEA7DEFB835B1028192D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457152, "uuid": "7e03b333-96ea-490f-a1cf-c2087f4fcfb0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457152, "uuid": "c868124e-dc00-4931-8ea6-87bca06e513b", "value": "24576:kRHE5UUqhCZCDhoseTZwaYQ46N4H1D4798BXkOJTs+Do:kxYUVCZCaZwjQ46NDKXTJTs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786457152, "uuid": "9aa20d8b-413f-493c-95b2-3e28666f4c33", "value": 1091072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786457152, "uuid": "853125d0-bb04-4f00-b247-3a67290411e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457152, "uuid": "7ee73cc5-470b-4a93-8fe5-f507634448f6", "value": "J6G5tzYJQyoHL3B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62256761-956a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786441957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441957, "uuid": "2dba006e-f107-459b-99dc-11f70a8d4ee5", "comment": "Malware payload (Mirai)", "value": "3ee3c2384d8ee461354f96ce151f9f19", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441957, "uuid": "6484646f-d196-450b-a8c4-3290ffefdf53", "comment": "Malware payload (Mirai)", "value": "2988472bee31e0dec5d8bbc97fb6f76ad01acdfb1ac5e67ba9ad59860b71ca23", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441957, "uuid": "1f5983ca-48fd-456b-bbbb-9e219721b488", "comment": "Malware payload (Mirai)", "value": "87958331aa0089ef329a21727b93371e59c76d53", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441957, "uuid": "9818c744-c9c3-4d60-b6fe-d6210106b318", "comment": "Malware payload (Mirai)", "value": "85b88ff7125ee6730aa24400fa94b0e9325a2a9e7567c9b956de23620c6156ec45fba620d4ce7cd74c5b59a409d04e28", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441957, "uuid": "1112aaf4-05af-4620-986c-2ed5ffd2d0de", "value": "T1BFE3C709BB610EF7E85BCC3B05ED270628CC596726A93F767634D818B54B24F26E3D60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441957, "uuid": "88906a8a-35df-4b92-be66-72d516b577da", "value": "3072:XXE83SK8IAQdWQaljsm/nENAUkzXCRVB728:XXEuSK8I7EQalj9vyAUkro2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786441957, "uuid": "73764ec4-c3b7-423d-a683-1859f4b54204", "value": 146468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786441957, "uuid": "65582494-a758-4dc4-93c9-05e54cc52188", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441957, "uuid": "b3c72931-03f7-4d13-a887-39ffb53b883b", "value": "Mystic.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96566e9a-952a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786414556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786414556, "uuid": "3c7fc0a3-ff79-4ca9-82c2-58dd2e6c7bee", "comment": "Malware payload (Mirai)", "value": "59dc6951cecb0f57ac1ef6408c343151", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786414556, "uuid": "89a0c044-9542-4f81-a0cc-5e3890efa3a2", "comment": "Malware payload (Mirai)", "value": "299b568e8d0725a31ae143c20554aef27c52a4cb1dbab0b718d997a0adf40c52", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786414556, "uuid": "134d50c2-9702-4af3-a329-9038bf550286", "comment": "Malware payload (Mirai)", "value": "ce8fc0161a59e6b0d31a4ecb2accfb5cb9215a59", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786414556, "uuid": "877a3dd3-14db-4629-86d0-93a625ea857c", "comment": "Malware payload (Mirai)", "value": "07d5f902956e8913a6fc023f68d5cb39a9dc60213e5e8ea500ae61b59deb9229aa29068aa0307b4e087384c56877463c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786414556, "uuid": "1869017a-7bfd-4699-abcd-be0aec678a02", "value": "T1C6F34A17BAC184FDC8DAC1745BAFB13AE931B45D0238726B27D4EE322E4DE304A6D954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786414556, "uuid": "e2b0d215-db3d-49a3-bbd5-5bdf910d3296", "value": "3072:93IgMevjGrLhEqzGUlkOcjGNjIyFx9M+0y6pJ3S7CTl1:VIgMevjGrLQ5YMVgk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786414556, "uuid": "0b0ed1e6-2ca8-4c65-984d-a0d7a6cff8c3", "value": 171672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786414556, "uuid": "302a1485-657b-4595-a3ea-08918c4c82e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786414556, "uuid": "d3058cb9-c474-44a7-9227-ed2ed34248cb", "value": "sdfjgnjsdf.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7dcee72-95d8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786489345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786489345, "uuid": "83833235-4ae1-4428-aacd-0557617cb406", "comment": "Malware payload (Vidar)", "value": "dbdd0437465f4391421cffa6180d6f4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786489345, "uuid": "e9b893e9-9b56-465b-b397-54970b2f4ffd", "comment": "Malware payload (Vidar)", "value": "29baaa328f50934d5ece6718dfbc7f0d4cf2dff007bd8f96bf6bc7a24f0ac331", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786489345, "uuid": "afd4d348-c2c4-4979-a13a-af3688b6a53c", "comment": "Malware payload (Vidar)", "value": "ae66de123d87ad3c9cff06686a35233610804b41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786489345, "uuid": "5f1adc0c-f78e-4246-8f3e-de417ed4a086", "comment": "Malware payload (Vidar)", "value": "f66fa44191a0ef7f480a8d6ff5c4c6a9405933589ba1bfece6fbbbdbd13caa101c0f658753b355cf4d1468c4bc03db28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786489345, "uuid": "8c93ba0a-0e59-4f7e-a7d0-2e3af8856999", "value": "T11B766A0BBB565E74C5D9D678C4BA82166A607C6DC7313BB31E11AEB03F263E15D3AB00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786489345, "uuid": "82caea39-b7f7-4cfe-89d0-d8925a04ce03", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786489345, "uuid": "247329b0-aafc-485e-b694-4b4f13ca65ea", "value": "49152:JvOmDOv2OeP5TkvLfdWcZuQYWotOfSqncxxY/cVvyuQc2k3rXVGHQGYCT3cN5lwk:JFO/WnKmDPW8HWRegsWbTLvEUQDb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786489345, "uuid": "2168d229-1cf1-457c-aee8-6876612b134c", "value": 7667560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786489345, "uuid": "2b8deb49-8b71-4851-825c-d119e754b078", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786489345, "uuid": "37ade776-d679-457a-93c6-409ce085ade2", "value": "29baaa328f50934d5ece6718dfbc7f0d4cf2dff007bd8f96bf6bc7a24f0ac331.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d783456e-95bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786478661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786478661, "uuid": "745a8cd2-a601-429c-b895-a67a736bc82b", "comment": "Malware payload (Vidar)", "value": "1562b2a2d554f5f9f41ad05414c4616f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786478661, "uuid": "f33c4719-07ae-49eb-a1e6-bc92ddc1bbec", "comment": "Malware payload (Vidar)", "value": "29e0fc6e480dc73a81e1162b614c4aac0b1a2cf93159f8ff43dc2798bbd89171", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786478661, "uuid": "d39df306-d424-4bd6-b3c2-23297c6176f5", "comment": "Malware payload (Vidar)", "value": "a1a59fa60d88c81a5d86749288f64356e5609b56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786478661, "uuid": "26165c96-e0b0-43f0-a09e-55e8e4434c5d", "comment": "Malware payload (Vidar)", "value": "27fdf8aecb2bd0f1f98a05c43100146afae8424f6e4c974d8db5c4a6dca67b5a81cd2c81d912fdabdae91e63cfc2ae9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786478661, "uuid": "0b9b976e-1383-470c-b1c3-4c27557a0d5d", "value": "T153765907BA948974C199E739D476521A7AA5FC5D8B3033A32D70AAB43F253F01E7CB18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786478661, "uuid": "d5c5dbbb-b6f9-470a-b443-5a86d45d77ac", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786478661, "uuid": "2aba395f-763f-469e-b445-e4dab689c919", "value": "49152:OOm6oT10f4L5chC65nyd0xMX1d4JSXIjL/Ihv/X2DoExe6DhwfcIytxy9+1c7uuO:OgjM6YjKDNJs37uOqEcvaVn5+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786478661, "uuid": "c288eec5-845f-4ba1-a440-c6e63bf9f5ba", "value": 7798064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786478661, "uuid": "880f12db-3ad5-4dbd-b66f-b289653c2129", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786478661, "uuid": "ef19e992-0e4d-4a69-adac-8cc33131b0a4", "value": "29e0fc6e480dc73a81e1162b614c4aac0b1a2cf93159f8ff43dc2798bbd89171.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2410e51-9593-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786459727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786459727, "uuid": "6992e172-b869-43a1-b663-bb6b8144b60c", "comment": "Malware payload", "value": "c0c6b6310a3f5626900f673746b7ebab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786459727, "uuid": "4b487335-a20e-46de-aec4-1196a3c97809", "comment": "Malware payload", "value": "29e97b2ae2e4c12dddaa69995462ffce950409f222242725f3aab323949ed8ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786459727, "uuid": "68fb9a06-2d12-45aa-9f2c-f2e8e0631c74", "comment": "Malware payload", "value": "9acad7318ff14ecdc1052697c5d64c6558332d89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786459727, "uuid": "ebb8600b-9365-4ba6-980a-d35915669d75", "comment": "Malware payload", "value": "5d7c2c42374872fa720a6a7541d17a775980c98b3d2b73674cb00854fca6db2ef4f9c4f6fc9ad8a71906216430572c81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786459727, "uuid": "9b5f291f-926a-422f-b64a-d031b625eb5f", "value": "T10E365B22959017ECE07FC179898A5E12FB317009136567EF09D045A3AEA7AF0BE7F352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786459727, "uuid": "df75e404-207b-4491-9ae8-7c361cb82ac8", "value": "c86ff6e3967f467999f37a6ea7443c31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786459727, "uuid": "8c823695-fb4c-46c0-a13e-acca49ee8c2f", "value": "98304:BVLnrOHTVjkcMMgohT3higkVgohT3higk:TLnrOHThq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786459727, "uuid": "b1e64c64-7147-4e57-9ae2-9c604fb44641", "value": 5125632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786459727, "uuid": "89906437-04ac-464a-b6ca-a12d2d946674", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786459727, "uuid": "47596f28-8307-4675-b0d6-ecfa47b7852d", "value": "29e97b2ae2e4c12dddaa69995462ffce950409f222242725f3aab323949ed8ee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d18c2a44-956a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786442143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442143, "uuid": "b3c9775a-3088-443e-91d3-8a9faccffac9", "comment": "Malware payload (Mirai)", "value": "004c074a2701e09840b792a6d1964323", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442143, "uuid": "0377187d-c247-4b5f-8464-3e3b8f04265d", "comment": "Malware payload (Mirai)", "value": "29fb9a765887bbfd0fea0b114808808452f53bfba4c033c6493ccfcffc604887", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442143, "uuid": "02e55c92-83fd-431d-bc9b-bb928b54463f", "comment": "Malware payload (Mirai)", "value": "26d8540286bc4b7430f00437ea27fe61e16905fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442143, "uuid": "95f12db6-f516-4764-84b5-b8445a8e548b", "comment": "Malware payload (Mirai)", "value": "99e5517ec61722314dd6544fd5dbf55b903a3514346f2186041947be7b4bf8273b74af2a5b78bc7747f3102092e06722", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786442143, "uuid": "14323254-cbe3-41cf-ba47-c3b3d49027ef", "value": "T18344B71E6E228F7DF369877447B74E34A76923D623E1D580E1ACC1111E6438E642FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786442143, "uuid": "e523833f-0b85-4d5d-b4c0-bac3042fd4c1", "value": "3072:5p8GOCLKGUXiUR1wxuQNchWRUftGUmL0O43z7cMKmgL7OAnOVcTaKRo+PSv/491i:5pHOCLhUXacARmt5EDKcac0aS3w1M9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786442143, "uuid": "279112c0-85bc-4971-93fa-f93f7cc36954", "value": 258580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786442143, "uuid": "b16b3b6a-b243-409c-9576-c0c3518dd229", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786442143, "uuid": "f8c79c8f-3f8e-4ebc-b9c4-4c93a2affae5", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2047a33-95c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786482034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786482034, "uuid": "e3ad6ba2-990e-4d2d-a734-c7ebd6856c84", "comment": "Malware payload (Vidar)", "value": "69da0bcf8b2ce89a748e5627aea09fa4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786482034, "uuid": "a93381ff-77fd-431f-b6d6-9ceb897816a4", "comment": "Malware payload (Vidar)", "value": "2a386e48c01010a779d4c1cd99b9909d48d25a8ba4fd5d3e70f98c9397cf0e7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786482034, "uuid": "3721cb21-23ad-4292-b2fb-139e5f9aa9c9", "comment": "Malware payload (Vidar)", "value": "ae3b34b38363ab3e9d832ae6f912baaa74144c13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786482034, "uuid": "7bd586ab-bd14-43ea-8ff7-ff92adcf32cf", "comment": "Malware payload (Vidar)", "value": "d08e5ac3da6fa765ffa9e4306cab4a290bf553b136205a782614f251f4ce54c5647ba0b1ce2cc2966b7537700dfdbf48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786482034, "uuid": "55773ceb-f626-4366-a21c-caecad06969b", "value": "T187E5AE076CC145E9D8AAA63289B351967B34BC184F3627D72F80B7782F327E09D79784", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786482034, "uuid": "1b2e271a-266f-495b-b8c3-54d607fcef76", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786482034, "uuid": "5017cea3-ac91-4de7-9285-9ad818008dbb", "value": "49152:Hu+FeQ+uQjV6xQ6Ii1gmL6AcptSZzHXXqIcwxYFJlge:Hu+p+AWipHnqIR+Jlz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786482034, "uuid": "ffac4ac4-c43e-4d47-86c5-5d536b7d2e05", "value": 3020664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786482034, "uuid": "680653ff-ad3c-4e0a-b5bd-382db3d5af63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786482034, "uuid": "7ea3e4dd-867e-415e-bd6c-111bc0c5ee53", "value": "2a386e48c01010a779d4c1cd99b9909d48d25a8ba4fd5d3e70f98c9397cf0e7e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "143229e9-958e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786457288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457288, "uuid": "36e085e4-14c5-4a26-a953-10bda13aa867", "comment": "Malware payload", "value": "6974cf91dc89329db16a2e4195e0ae65", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457288, "uuid": "b341d68d-9d7f-45c9-bc9a-118ff9413a91", "comment": "Malware payload", "value": "2a42d99aa2e1ced919243eec1d1d90593309073ed731a5095022c3d497e0b418", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457288, "uuid": "dd3944d0-1023-4934-81e9-4ee561c31e36", "comment": "Malware payload", "value": "69c8a8878a6a32d2a982f8a490bded9aa053d49b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457288, "uuid": "635745d5-ff25-490a-a9e0-5e36a85de295", "comment": "Malware payload", "value": "49e94e79c9b49aab47936ab9538c4844268beaf14cce25522a53e1b7f6df267a70849bb83ffee0b0c02004c4fe1189ea", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457288, "uuid": "9526ebd9-4589-43b1-9912-adda3f9abd4b", "value": "T16F4158CD11854A392CF29E7E71E54C58F3A1A0B720D59F8A98F734B7408DE541D82EDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457288, "uuid": "8788c244-6f2d-4e42-bbe8-59b34d7bc72d", "value": "48:v0dj60sM9p0hdhjW0hvi0CGV01rI0YgH0c8F0v5m0DVg0SW10gYJ03v35a4:v0dj60sM9p0rNW0hvi0CGV01rI0YgH0C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786457288, "uuid": "c3353d7a-fa4a-4818-9ce2-e4863e549aaf", "value": 2334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786457288, "uuid": "ef4f3652-bb5e-4665-9b6a-c14e4bb5cb1b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457288, "uuid": "28b0a649-fe8f-42ac-b383-0374a2e02bb8", "value": "lg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1ec143b-9562-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1786438681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438681, "uuid": "8c431948-c452-44d2-80f2-7d43f380546d", "comment": "Malware payload (XWorm)", "value": "cf9d18ba648920937cfc3588fcda2264", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438681, "uuid": "c457d1ac-8f08-4833-9d40-18cb515bdcbe", "comment": "Malware payload (XWorm)", "value": "2ab1203a41aa0208cb1d0123ffac2c284c62bbfaee0dcd1dc3eb38cc1021c66f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438681, "uuid": "658a7049-9661-4d9a-a661-a94b541da4d0", "comment": "Malware payload (XWorm)", "value": "8f1fa077ce07400034a8d0bee56a05ff36cb6e1b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438681, "uuid": "9d0d6d6d-8abf-46a6-a7da-a48fba9c419f", "comment": "Malware payload (XWorm)", "value": "718aef5aa3a5899e647d0b00494ca9c5da3422414f56c288a586c856a14ad121dda448e35656e5be44f37007a7226d3b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438681, "uuid": "f7771436-28bb-4ef3-9743-f5788673e43a", "value": "T147B75EDF37FEF5C6E48C8205DD8680A09D07858B323A559C659CE5C669B2FC8C834BB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438681, "uuid": "c27a07ac-0f94-4446-b583-de8e759dd086", "value": "1536:XzF+++gOzHzbE11HzbEXBT+OzHzF+0EXlggOzbEF+0EbEHz1F+AF+++g0EXT+OzS:CZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786438681, "uuid": "b50798c1-cad1-41f3-994c-b65c8d905203", "value": 49355766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786438681, "uuid": "de2484b4-a637-4324-b2f9-c68ab6098035", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438681, "uuid": "eec3c277-7f3c-4288-9c73-86d207970d8f", "value": "FATURASI.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23931475-9556-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786433262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786433262, "uuid": "7f1e3474-5c01-420e-9cb1-ba4457267542", "comment": "Malware payload", "value": "3a95d78c21c7bb17a77f86b8c6cfd1c1", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786433262, "uuid": "f4db0076-7a19-498e-8039-6fbc4a09ecfc", "comment": "Malware payload", "value": "2af7b39252ff74e14f82aba9f3ff715a2c3425c1ef5eda97e3b9712937d1062a", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786433262, "uuid": "276acc1c-e2fb-44f0-b56e-33ac14384ac5", "comment": "Malware payload", "value": "bb00c5deb7b1964421627dd5c7e15873bcecf69e", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786433262, "uuid": "77199f90-c271-418b-bb47-81b8de2b9005", "comment": "Malware payload", "value": "0d6f53b55f076b68dd1a813dad1bff8369c5cffac16d4c4abafb9ba40e8685c433ec4ea71e31a63c07abf21fa9e6150b", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786433262, "uuid": "0535ff79-b76c-4913-8555-9c2112b1e143", "value": "T106D39C0169576535C854817BAF4C12DA05ED07E6A637B0CA2CCEB9C8EF932B3C273E95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786433262, "uuid": "ec0b31b3-56da-48fb-84ec-9484fc83c593", "value": "3072:hp/MRQBRjRWlf75N50ZCDS1roWHPoWYm3z:7/MRQBh61NaoIPoi3z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786433262, "uuid": "f7cba7b2-ac5e-4688-a3eb-6cc7509cf14d", "value": 135385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786433262, "uuid": "3f0b2c7c-5efd-4d99-8554-b66290d6ff4f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786433262, "uuid": "9f78af6b-5005-4c60-bfd6-6f56896108b7", "value": "Quotation.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "622431b8-9571-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786444963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786444963, "uuid": "8fbab0d5-d9e6-4e05-b418-fbec947bc5b9", "comment": "Malware payload (Formbook)", "value": "568c201c533fa5b4f83de6eb9da991a0", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786444963, "uuid": "e32582fe-76e6-4cc3-ab68-a1f81f8a9afe", "comment": "Malware payload (Formbook)", "value": "2b4f71088b02ab4123f286a9f59629e39044c8ab5f14b931cba1b49fe03f5aa8", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786444963, "uuid": "3a479937-96e2-459a-8283-e00b08975a43", "comment": "Malware payload (Formbook)", "value": "e3de6335604d7d0f1258bc4c6d4db862605b0741", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786444963, "uuid": "47d3ba77-81c9-430c-8cdc-c7a046424864", "comment": "Malware payload (Formbook)", "value": "a380018f822a43492b88bb5cd31a0385af6e95ca4237e6ca87bae0f03f22b4c1ff4ecbf05697bd8f7134976808572975", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786444963, "uuid": "747ab679-75d4-4652-a108-f9390185c875", "value": "T14BA378A8C38F00A5CF18A37B52674E4846F9B73EF20195B2706C677033ADD2D5A6647D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786444963, "uuid": "4391bc97-3494-462e-9635-f83211e9044e", "value": "768:mZZXqvJ6UsENujxHRMwQ/9i8OTvf9EoZI1fCAZ:P6UsE8xRM7i8OTv1EpB5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786444963, "uuid": "9ef7190f-8d0f-4126-ab2d-a30f4ef4a9ac", "value": 103370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786444963, "uuid": "a368fbfe-3c14-4c24-b68c-4f781e14878f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786444963, "uuid": "31f25131-bdc8-43ee-9d52-2066836d6d83", "value": "PO_Eco-26081018EA1.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f600986f-95cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786483866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786483866, "uuid": "51746a32-6a4e-4da3-a48a-b62eec14d5e4", "comment": "Malware payload (Vidar)", "value": "351407d1cd239fa927e83a54ed89eb24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786483866, "uuid": "4b9ae719-d296-4d3b-8d6e-011a9c45922c", "comment": "Malware payload (Vidar)", "value": "2ba902b3eb1c726063e93872166c93bc4142c4f52a17675f995c817f16450c16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786483866, "uuid": "b76c9ac8-0732-4148-ad34-a4ff6589de80", "comment": "Malware payload (Vidar)", "value": "06b0f239ba40fec4235a996b2cbaa7ee79f7e16d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786483866, "uuid": "b05adfd6-0d08-4e22-9422-170020bd6b85", "comment": "Malware payload (Vidar)", "value": "1b14881a32d4585082ef51319736ea9100de125471ba5faa8842ed38131354ee8031317e86bf0877b4a477943ef927d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786483866, "uuid": "9e19edb2-1d9e-4bd5-abfb-72aed43c5b28", "value": "T106F59D07BC904DA5C496663289BB4291773CFC544B3A37EB2E90B6362F767E18C36B14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786483866, "uuid": "76be0e6c-eaa8-4096-b9e2-86a86741ae86", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786483866, "uuid": "028ae466-874f-4644-a259-9d066161d986", "value": "49152:fs3SOdJCEih4+16IOPONVMmyasZ1NK50nRyFifrw/mj9xbs1jQkx1:fsJv26+Vxy5w5Ymi8OjTbcQkx1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786483866, "uuid": "8a204f72-fb2b-459d-b4f8-7ead0e8baa45", "value": 3642592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786483866, "uuid": "68a52e53-a7fa-408c-af42-2e351b38704e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786483866, "uuid": "75ab365f-f3cf-48ff-bfa3-b3741c56ade9", "value": "2ba902b3eb1c726063e93872166c93bc4142c4f52a17675f995c817f16450c16.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "526c3c6c-958f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786457822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457822, "uuid": "d0ead721-264b-41d1-adfc-3f1b9b512eef", "comment": "Malware payload (Vidar)", "value": "2d79ec6eceeccdb7f039e43c968c4805", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457822, "uuid": "376e23d4-32f0-4e95-977a-62df933c7de6", "comment": "Malware payload (Vidar)", "value": "2bb2feebe6db9414588a43cf7d31ce1389641f9fe73617a814d6e3f60a035f2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457822, "uuid": "aece3256-3a8d-4c84-ac10-169377bc2fbd", "comment": "Malware payload (Vidar)", "value": "7f13ad3f01eb25569634591241b9f504e7046e9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457822, "uuid": "df24db3f-9458-4a13-9564-76c2c8f4cafa", "comment": "Malware payload (Vidar)", "value": "98a6476d9b69fb209bc92dd91570cf74f43e395f3846854332f226f3be27d6458a45f110018915caa9eacd4fbefe9b6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457822, "uuid": "bc594498-55fd-4189-9a58-3adab48e951d", "value": "T105368C17AE9408E5C19AEB35C9B75211BA74B80D8B3123D32E50BEB83F723D1AD75790", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457822, "uuid": "558df08c-b30d-4d3a-88cf-194c416989b8", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457822, "uuid": "51c9cc9b-188d-4965-a900-a6f25fa0cfcd", "value": "49152:W3ybeJFvq9yhNDN5wpbZTErI9cTHlAC1vzX3sYf3mQYEb/YOYtyodRVK7vq6L:W1rbas1vzX3731oFG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786457822, "uuid": "a4743018-95a6-43bc-9584-9faa6ce8d6cc", "value": 4921184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786457822, "uuid": "b0ca92e4-6e13-43f4-b840-3320002d4ddb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457822, "uuid": "9e983613-fded-4540-bb95-35ce17251fa6", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81102f57-95d4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786487535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786487535, "uuid": "04432981-4a9e-4938-b7c3-31cdb9c2f34b", "comment": "Malware payload (Vidar)", "value": "ea54e3e4d5f97c68d16eebf6afae8202", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786487535, "uuid": "edf21da0-4cf7-4ec1-bbd3-82d0d4535768", "comment": "Malware payload (Vidar)", "value": "2bd55986ae39d75c337ad3fd7efffe8f5fdf9064a6859f732a475f0ceedad996", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786487535, "uuid": "8e45c130-7201-47b3-a48d-807970c72480", "comment": "Malware payload (Vidar)", "value": "a09f2e1197e5a7bb196f22e9fba7c619ab419967", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786487535, "uuid": "68e81b6a-9b35-43e8-bc5a-474843b90774", "comment": "Malware payload (Vidar)", "value": "a06b436e6833d951628aa7c12ea0532e8dd679cbf5cd2d4e8b16b046731f98f22ad290a398d9b5018e2cfab39356f253", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786487535, "uuid": "923576a6-e268-449e-8a1b-227f9e1dc49c", "value": "T1D3765C03EA921EA4D1A5DB79943B8152E964BC6DC3343BA36E21BDF03F263E15D35B10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786487535, "uuid": "dd2fc71e-b362-41de-9006-a674f9f5d56b", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786487535, "uuid": "3cd9549a-cae9-409d-8968-bb25dae63d8b", "value": "49152:OHTMzfOx/EYSjWxapvonL6jhxRIAEHrNHq59qn+FjUjBBABjQTA94+d7Fme:O4+noEaYrE5gKAjBBy4A94OFme", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786487535, "uuid": "e7319d30-752c-4a31-99ef-702cbf9c4f2d", "value": 7796456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786487535, "uuid": "766523da-39e8-4815-9792-95d8f84801c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786487535, "uuid": "4c2bbf86-8d89-41d4-b34b-3009344ad7c8", "value": "2bd55986ae39d75c337ad3fd7efffe8f5fdf9064a6859f732a475f0ceedad996.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe78ce88-95cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786483880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786483880, "uuid": "54e408a8-e05e-4663-90f0-b4bdd6456cf6", "comment": "Malware payload (Vidar)", "value": "464ce3a8ac8793e0dff4ca964dae68dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786483880, "uuid": "38535871-97e4-4afd-8fcc-ff8a10664f09", "comment": "Malware payload (Vidar)", "value": "2c1f52bc82354ad4d965c05e7a1e59f4f1e526949b0f10767edadc26ad103943", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786483880, "uuid": "145634fc-93c8-4898-abff-0906d76afec6", "comment": "Malware payload (Vidar)", "value": "1134c76c8648df8a8cc2b400b8a89494a56adf56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786483880, "uuid": "02de48ad-d163-4067-8a1b-830d11caef40", "comment": "Malware payload (Vidar)", "value": "c75438988efbe60759ac8eb4805266ac233e701e61afca33600a1c67e87b971bcd9103a2c8b23050f0e3444fa1352de2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786483880, "uuid": "cd33f54d-4bd7-4eb8-bacf-0c32071b3d50", "value": "T17B06BE0BFCE049B5C4A9A73649B602517778FC6A4B7263E72E80B2353EB23E18D75750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786483880, "uuid": "c30541e7-10fb-4325-8007-6510a5cf6705", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786483880, "uuid": "47fecd75-21d6-4a6f-9b89-058d107dfdb9", "value": "98304:Dw/dAWW1llN/OVUHuBMUqU9xlBLT8E5xo:DwlAB1llN/OVUHuBMUqU9xlBLTj4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786483880, "uuid": "068ef0f7-fa3e-422c-8b85-e050190dd6e7", "value": 3867952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786483880, "uuid": "6e057863-8ac5-430d-8f97-01c70d69bd9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786483880, "uuid": "bdd90890-e01f-476d-bbab-c59fe8fa6688", "value": "2c1f52bc82354ad4d965c05e7a1e59f4f1e526949b0f10767edadc26ad103943.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fddee689-95ba-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786476578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476578, "uuid": "d524f837-1c9b-492a-8477-d1bb048b1e7f", "comment": "Malware payload (Vidar)", "value": "e92311d91b9faab12e95bb3f80abeb3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476578, "uuid": "92ca6170-c4e4-4d47-bd3a-49eb90f26706", "comment": "Malware payload (Vidar)", "value": "2c2f33587250ab0439757744b0328efcee3178d796b2e3a3bcf990ee465848a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476578, "uuid": "22ca8914-ee41-4a20-883d-c20510c909a7", "comment": "Malware payload (Vidar)", "value": "a6527fb0ac6987419e59695fc8bda69ccbda214c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476578, "uuid": "ca241df6-0b0a-4583-aa26-3a14341c1280", "comment": "Malware payload (Vidar)", "value": "000e738e0facca0d470f1d8140f13aefad1b4d39dca6ef1fd238a76f56226f7205b2f91b25234286661f573882f44eb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476578, "uuid": "f53b8d4d-f7be-4aa6-b5dd-dd3e7af27a57", "value": "T1D3367B13AE9148FAC2A9E735C8B74245BA70B80D8B3123D32E617E782F717D16E35B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476578, "uuid": "cd7c3354-853d-4279-814a-7ceb70347e6d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476578, "uuid": "b0ab61c7-1b93-4c3e-b6d0-b4264c8ae982", "value": "49152:gf/XReJdsQyZI2JzMVCB6UAI4b4sdeFZOXpTL9A5Nk8:gXxL3L4ssGcpL9n8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786476578, "uuid": "3e0946a4-92fb-442c-bc89-54e13211ce26", "value": 5163888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786476578, "uuid": "02437364-6508-4d30-8e8f-234d8cdee928", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476578, "uuid": "95e9e01a-2a71-4b8e-9c0f-1a4183f48d70", "value": "2c2f33587250ab0439757744b0328efcee3178d796b2e3a3bcf990ee465848a5.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cfbfefc-9588-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786454806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786454806, "uuid": "a56eeadb-84a7-474b-bcca-5dca0db74ffe", "comment": "Malware payload", "value": "a2eec217fd4895040aca13008f4a8b2f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786454806, "uuid": "1a5f9c18-2313-4781-aa54-7b68e7ddd2b6", "comment": "Malware payload", "value": "2c325c013a4dfe170c1b905e7a9df373476fe1fab35dc008b0209a0d7c88f2fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786454806, "uuid": "1ac658b0-31ac-407a-8033-9f25cc7e0883", "comment": "Malware payload", "value": "3522fa450e19883b0565034ac88b3408cd2e8bae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786454806, "uuid": "fb749fa8-f59f-4299-ac72-bc3cd623672a", "comment": "Malware payload", "value": "d225ff8eaaf6159a1817a9714268bc7d0807d9261026289bcb0a41a54a84974d2460495258651e15e84bd1cfd75d9c60", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786454806, "uuid": "3405b51e-256e-4403-93a5-c96c07b08152", "value": "T18413F913DE66C42EC84AA1B05BDFD629A533B8BA0335A4067790FF705E859C0EFB5253", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786454806, "uuid": "037930c6-5c1e-485f-b296-a9a75dfbd98b", "value": "768:80wzp1PmYXN+nByyit6JqMoFagbR91UXHbQ/2Gkwr/2E5:PEp1PmYdOyZoJqnfR9ab3lwr/2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786454806, "uuid": "86d75b76-6bd3-4502-932d-0a96821229c8", "value": 44744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786454806, "uuid": "9ae6ba7f-f929-40b6-8542-c4f45c14c48d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786454806, "uuid": "276d115a-c99b-43aa-8605-8761b39cdf1c", "value": "main.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e2dcba5-9573-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786445815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445815, "uuid": "1e87a3ea-ccf9-4e0c-a638-c3dcd82b43b9", "comment": "Malware payload (Mirai)", "value": "52dfed23e7da0ce239b4eba4e2d32633", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445815, "uuid": "60521717-164d-43a7-9b8e-9cb106de2bb7", "comment": "Malware payload (Mirai)", "value": "2cc8098855b6c53cdd15aea0b89fd126b52605f36965d9567f3862a74ff8da3f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445815, "uuid": "2e4df24d-091f-4fc5-9147-fee4aba3c2ea", "comment": "Malware payload (Mirai)", "value": "8fa5baac47753b3c31e6be53080a5be22c7b2aab", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445815, "uuid": "7c56cfb9-2485-488c-a7ec-4f007dbe4cdd", "comment": "Malware payload (Mirai)", "value": "fbb79d46078971e4dd9092432a080805e8883d06e72a98048746661b84307745e97046e07ae7905cb31fd22328cac5f7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445815, "uuid": "f8e7f6f9-3a87-4486-b945-a0a41757f8ab", "value": "T1D1F38CA2C8696FA8D219A5B4F074CFB92B139150614B1FBE2177C2758487ECDF6063F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445815, "uuid": "6d5ff8e1-3307-4c66-9719-1bab380cbe56", "value": "3072:nLZDPEbFDaS+MiYCGnfDxiP1N8LI4Wx/lnDz:nNDs5GSgYCG7xiPPJhx/hDz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786445815, "uuid": "4c2d241f-54ce-46ca-a4af-7ab3dd403f13", "value": 158124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786445815, "uuid": "13abe253-237a-4cba-9e2d-59d2345fc362", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445815, "uuid": "a9b9100d-ab7c-4ca8-8b10-6ba0b5d1f26e", "value": "sdfjgnjsdf.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c38c644-957f-11f1-bd95-42010a9c0009", "comment": "Malware payload (P2Pinfect)", "timestamp": 1786451047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786451047, "uuid": "4a5b0036-1eba-45d3-959a-26d878ba335a", "comment": "Malware payload (P2Pinfect)", "value": "2e116e9a6e67bf35d6002b336fbc2792", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "P2Pinfect", "colour": "#78D613", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786451047, "uuid": "a77ccac3-22b7-4cd6-a91a-d0b87331f60d", "comment": "Malware payload (P2Pinfect)", "value": "2cd3b303261fc411a5496420d8b3f607dc0631ab86c84eb6af1c6d625d5350b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "P2Pinfect", "colour": "#78D613", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786451047, "uuid": "7206d388-0d9f-4d89-ac87-507b7a58ffa3", "comment": "Malware payload (P2Pinfect)", "value": "1d76950e508ebadb5193dc6d031b659f0f2f3136", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "P2Pinfect", "colour": "#78D613", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786451047, "uuid": "7f395d32-2351-4941-a69f-a0c1cf81d7ca", "comment": "Malware payload (P2Pinfect)", "value": "aa7b5d67d68a299e9dcf6028854e9a3fd8d0f347bbedaec896f49b567d126cddb22d7f457503969d53b3d38390481623", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "P2Pinfect", "colour": "#78D613", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786451047, "uuid": "85367569-b203-4d3e-8439-6a5d8b74d661", "value": "T1D98533D283DDEECBCEA5DEB8B73E7AF86010E159F89407440919E601D5FEBE6564200B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786451047, "uuid": "d7962125-50df-4e60-906b-b34bad785eca", "value": "49152:JUo3eDy7w74VLQklva8Z2iqxpjNkiJ8Y8rTu9HUcO:JUxDZ7CLc84iqxlJ8PTuJUf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786451047, "uuid": "04e67b06-d0ef-4ff3-a2bf-fc1b6076e205", "value": 1778300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786451047, "uuid": "660d5ce9-594a-4345-9388-2c81dbb52ed2", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786451047, "uuid": "40421e9f-e573-4e30-9419-40d3b70dae9e", "value": "linux", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2155ee0c-952c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786415219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786415219, "uuid": "d2c137da-0ecc-4dbd-98b6-d983e92edd41", "comment": "Malware payload", "value": "0635ebf6a2ee2b451277c17db64f679f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786415219, "uuid": "98237d97-3c74-4e8d-938e-b67e95d50c38", "comment": "Malware payload", "value": "2d344afeb8650715faa758e2627f8b038f601f96696e44dfbd286e7edd0d5fc5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786415219, "uuid": "c694c2eb-20bc-4e7c-bf4f-0a765c2f6cf8", "comment": "Malware payload", "value": "a66daeea702b6e38e259d3ac241af77b41904a15", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786415219, "uuid": "0c0e5b04-dc9d-4d32-b6ce-57f40dda1d2d", "comment": "Malware payload", "value": "320b505585399c1c5bacd27ed4c860629283148b43d5eb254d8f3964f7bc2f66266a3d2bc01ea0c8bd90a4758460572f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786415219, "uuid": "4b657e44-4d6d-4349-a2b4-c955464c49e0", "value": "T187D31A02ED856EFBC01FCD70452DC24A15D65CAA92E5A22F71FCC98CBBBD74646D3888", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786415219, "uuid": "d7bdcf00-282b-431a-a119-14f2029ad1b6", "value": "1536:01EilXd/nmKQwLDuPUUQLtv8lxkYTZ7h+4erYJOwZORbBpyjpm4XLMzEr:ZwweLDyUd8lZ2qFZO56", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786415219, "uuid": "a163ec9e-9fb0-4ec2-9872-af6f76e46ddf", "value": 140032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786415219, "uuid": "d0612210-637a-414a-987d-1aeb2629214a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786415219, "uuid": "91b2c524-7e0f-44e2-937c-9ee43260d00d", "value": "main.mips32el", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d28834a-9583-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1786452766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786452766, "uuid": "e56a301b-533a-4d9a-bdd3-dbaab6fbf148", "comment": "Malware payload (RemusStealer)", "value": "1acf80a7614b6a9f25b6cb902d65ca43", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786452766, "uuid": "01dd7486-9df0-43f6-82eb-4a2dcbbc6d50", "comment": "Malware payload (RemusStealer)", "value": "2d6d7eb91a0244520c23bdc39e5bae2db67fd0156977936448748aac61d8802d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786452766, "uuid": "1fbfc98c-4ba6-4675-8099-162cf82ec248", "comment": "Malware payload (RemusStealer)", "value": "a1c7bfc276dd297fcbc5d0a67a37be9dc6e237de", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786452766, "uuid": "5d6095b4-ac3f-4cc5-b2d1-f5f230a3aa4a", "comment": "Malware payload (RemusStealer)", "value": "81177dc96b19551cceb4c0c0e1b87dfff5931258fd53778fc7f95ecdbf98acffa2a1a7412d4e9714b8d5c2eeaca421a5", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786452766, "uuid": "14647cad-6c41-461b-97b0-8eb57cc4e67b", "value": "T16CE549077DA148E9C0E9E73189A75651BA70BC4C4B7533EB2E90BA782F723D09E35B41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786452766, "uuid": "14407424-8a75-4400-93e6-e941ca398e7c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786452766, "uuid": "b22bb598-7e89-4b12-8821-0d0a0af33e46", "value": "49152:UhGhXL9r0mvUYyHic4pCRMDOZIn+V5nrdksi:UQKVKSKn+q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786452766, "uuid": "b66e3d85-5108-401c-98dc-2b4699ce2833", "value": 3106664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786452766, "uuid": "3176ed62-c35f-40b5-8a2d-cc1870a163bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786452766, "uuid": "2bc8b564-54d0-4392-b34e-e372b4581959", "value": "bhatta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdc17fca-958e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786457599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457599, "uuid": "10984786-cec5-439e-a157-c5b066fdde39", "comment": "Malware payload (Vidar)", "value": "28d4eaf220b15d9e224e579de90ebf44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457599, "uuid": "32f2c233-1d7c-4bc0-a4d9-525bd7092fa7", "comment": "Malware payload (Vidar)", "value": "2e2420cd6378de828f9ae524f357ab6135107a2f5864e8d7858a200d5b3a29fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457599, "uuid": "f0a6d3f8-2863-4a79-9870-4aa83904eadb", "comment": "Malware payload (Vidar)", "value": "a045018b3f997df66d22af9c9e28496be1514fc4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457599, "uuid": "a24063e5-e440-4124-9a35-3e9f03962d83", "comment": "Malware payload (Vidar)", "value": "5b9db0ef141d8e78034afd0848bb44d4c79767d90caa3477bea79df66e802cec3e37b67a3a6cc9512ecb0686abc2d1ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457599, "uuid": "7c226517-b20b-4e06-be77-a74936707969", "value": "T1CB365A17BE9048FAC0A9E735C4BB5259B670B84D8B3123D32E516EB82F723C16E75B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457599, "uuid": "3afbf1be-c90b-4498-8cdc-ec51e0b5e71c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457599, "uuid": "769994bb-6088-4b45-9cb4-8d5a5ae9bc47", "value": "49152:wdy6aMpzDt819czgwq6dSmFYireX2Cgv9JoMADPkyu:ws2ha/X2CgFqMmPm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786457599, "uuid": "4b640d16-4be8-4db4-8246-70efb786579e", "value": 4964224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786457599, "uuid": "0d470887-5208-4554-b7af-2c37bf7d7054", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457599, "uuid": "a1b99c5d-c485-486d-8212-c190139d8ebf", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2064c6f5-958b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786456020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456020, "uuid": "8e0c34c2-e33a-4538-a69a-28d592e9d3c4", "comment": "Malware payload", "value": "e88c38c228d8539cb17433c09f76ec72", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456020, "uuid": "8ab08dda-215c-4276-b4c4-a97930547bd3", "comment": "Malware payload", "value": "2e6392fbd83fb39978a78e20e95e87f31b32ba2a7ca09ab9a12f302d9b376dd8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456020, "uuid": "03cbb0e4-beec-4a06-921c-00988184cf74", "comment": "Malware payload", "value": "3108a3bebb2c9adebdfc124b25c7bca4c2e4a656", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456020, "uuid": "4955b020-5619-4240-9928-08cbb7e8da43", "comment": "Malware payload", "value": "555adabd4f8027ab54e040cf6ad528bae721d45b596ae14cf67920b14f778e0a52732d87bd9a24758e6ee990f108458f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786456020, "uuid": "2d438ca9-96e3-488d-b472-e2a0f8406693", "value": "T185635116AF629D77C84FDD7301E8860124CCB49B52A92B2B71B0DE7CE75A98F05E3C94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786456020, "uuid": "c5e9166a-42e2-4ec9-9eaf-d21ec7cd192c", "value": "768:nV1O0IguNkbpRyeCXN/meRlZGWyJlCOpX/7ko8Xi2n5wGtKnU8U5CzOg:ngNktRyPXYIvGWyJlCOpX/AogwGCTnB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786456020, "uuid": "c9fcd7b3-4ba4-4d61-a809-ebabb39adc40", "value": 68512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786456020, "uuid": "57890ea8-0ced-493b-83a5-6c589ae907c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786456020, "uuid": "5527d257-bb4a-492b-9542-6c34babb6cc6", "value": "main.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de2b614e-9548-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786427562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786427562, "uuid": "fdd8dbad-c08b-41c0-8a5e-b2f447cd3a44", "comment": "Malware payload (Mirai)", "value": "314a42f205f14ee29ddb0c6c3add23cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786427562, "uuid": "73fa2ecb-ab23-4e82-a16c-c739787caacc", "comment": "Malware payload (Mirai)", "value": "2e7410c0c300b65720eb170d3e661faa0df52e5fd4d3309ff9bf9301a2cda679", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786427562, "uuid": "53e90ebd-9ee5-4d20-a4e4-c59e37c35268", "comment": "Malware payload (Mirai)", "value": "d60f0484b1e4f63dc41e3e8d40a986dcee0dd481", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786427562, "uuid": "51056fdf-1adc-4bc9-9ca5-083e1bd98658", "comment": "Malware payload (Mirai)", "value": "d58167d443a770c71fc80663eb89cf9ec32413c3d74c50b4db267343751c2685b2a9052b44bd7d2b358164c2a1c6b07d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786427562, "uuid": "372e6861-1d0f-40fb-87b8-e825c076a695", "value": "T12E4301D9AA1CA056E534443BCDB28BD1DD775FA916FA7170A0091B36B2C8ACBD07D343", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786427562, "uuid": "514c54fa-e158-46c6-8973-960f1981a177", "value": "768:IEBd2jq45ged18OCVJRaPjVYUnSxJ1MWenl19OBkCJ5xxABGeZNY59+ulYlBtg3/:feBd18zUjVDSxJOVDUeW+RlBjfK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786427562, "uuid": "1c540994-fb2e-480c-a216-8306918a5938", "value": 58528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786427562, "uuid": "b1eec54d-9a93-4888-a70e-627fa839b2ca", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786427562, "uuid": "75fe195a-9563-4a65-9817-476babfc69b6", "value": "putita.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14fbf8b5-958e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786457289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457289, "uuid": "de901e8f-d50e-41f0-96a8-1bb784aac7d7", "comment": "Malware payload (Mirai)", "value": "05fbdc7fe48fc48e1432adc3035dccaf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457289, "uuid": "1d2e2319-77e2-464b-b2dc-97b691a261bb", "comment": "Malware payload (Mirai)", "value": "2eaa6f14174679b1b58fec69cde64c1c8b5fdde0478b5d5e9535ae3450943eca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457289, "uuid": "fa6eb909-cf06-440f-8405-26ecee18b2ca", "comment": "Malware payload (Mirai)", "value": "89c78e4fb9773d7ad0f5932a65c1291ddffa183c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457289, "uuid": "09848556-b0ba-45d9-b2f5-eb05365959ce", "comment": "Malware payload (Mirai)", "value": "2ba6b3fc31a4dd893b7888b981061e9053e3a71aa5f7d21e615ef5c9bcfeada3921dd61670b393926b7ff8445ddb7f78", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457289, "uuid": "aa03cd2c-f78d-44d9-852a-81f427328ff5", "value": "T199C31B45FC405B23C6C612BBFB5E428D3B2A17E9D3EE720399255F60379685B0E3B942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457289, "uuid": "1e111a9a-cfbb-4590-8fdd-b62c4e8b6760", "value": "3072:pKaprehX/OXWFh4UXIkFYPpB5vW9Qsiy:pKpGXgh4UYkFYxB5e9Liy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786457289, "uuid": "a898155c-eb1c-458a-8a75-b9174e8920ba", "value": 129824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786457289, "uuid": "1be13d9f-1a8e-42fb-a728-614957b79ac5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457289, "uuid": "fc13ae85-63c2-4d6a-9993-88084323928c", "value": "bot.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d34a462-955e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786436687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436687, "uuid": "6db2e15e-d772-4ae0-8b1b-7c69047dc377", "comment": "Malware payload", "value": "ccb189fa99a86c75fa877101acdcf8dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436687, "uuid": "37185f92-7f83-4b32-aff0-faf8379e4c58", "comment": "Malware payload", "value": "3004e2277e4087a0925393a7a4b21ba093d851a75e6075aa4b516bb6edbe66e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436687, "uuid": "1e9aad0b-bdcc-4d9c-a356-b7cf8e77535c", "comment": "Malware payload", "value": "ff38e9657c59e46a4acb0e7abfe5cf7305875095", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436687, "uuid": "eb0c94b9-bfbb-49fb-a140-3c52944df0ea", "comment": "Malware payload", "value": "9b1888968f6843028d7372f90d40b414ae81eec4e84b6be56ecd0255460abde17cd0a859ac61a4b819f975640207a807", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436687, "uuid": "41359ee9-5c32-4146-a654-96d9e917d007", "value": "T157D523D979B31DB4C873CBB28F82E86E71697B9D8A318E9637CD29004E53A445D36334", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436687, "uuid": "6bfe9c8b-00ad-45ad-bf9c-4827e482f877", "value": "f5bec796b7b3c2932293afa8281cdeed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436687, "uuid": "7407a019-2eb4-4c25-b881-06dd6799bf6d", "value": "49152:kikEjqrZ4CsnZTUW96bEEVIkp/BtO8QJD+Vf9vDeCcjmKJp50vfqsdd7:kikKqunV98VIu/fYJD+VJ8Jp5QqsL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786436687, "uuid": "19198c2a-fbd7-44c3-98fb-1adde613ff75", "value": 2980352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786436687, "uuid": "be1a1882-45d4-41bd-849d-187deb05a3da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436687, "uuid": "667eb2e9-a190-41dc-8656-7d046e70d107", "value": "9z7BGnRGpgs8cZv7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82372496-9579-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786448453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448453, "uuid": "27439038-107c-44c4-a07c-da30a2ccb970", "comment": "Malware payload (Vidar)", "value": "cf2c71f03773e292fa1c48ab9cbce5bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448453, "uuid": "79300145-2b7a-4940-a02d-50854943faf0", "comment": "Malware payload (Vidar)", "value": "300f73b9997fc04aefac07b67f46d90a4ba6f919a32dfc0d86ffa52933a24d94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448453, "uuid": "ec2dd16a-a83f-4c76-97c3-afb64c047195", "comment": "Malware payload (Vidar)", "value": "4732ad913c57c468b03b2b3501569874b531756b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448453, "uuid": "aa83de8e-f6f5-40fe-a841-13843f0c61de", "comment": "Malware payload (Vidar)", "value": "e6721b5457b3d89918c1f1097a3689645f87e0f3c48c74666ca9e47c2ec3c4d1258365bf07161adfe05edebbf6727ae5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448453, "uuid": "d0175054-60bc-4656-9891-f31b2a65e55a", "value": "T163169D03EED14CB9D456A2328C775682BB7CBC091B3233E76E90727A2E757D06976720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448453, "uuid": "543b7f36-c048-407b-ad90-d4d6d58f9b12", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448453, "uuid": "75108e0a-4a4f-43b4-9640-fc162ba17472", "value": "49152:47qVt4lMWDYQVyy8041UympAG/oPkB2+wDjEDAMnBplRp:4QTkCUyzAAEDLBPRp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786448453, "uuid": "8745737f-e06e-46bf-b715-054178f49b36", "value": 4082144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786448453, "uuid": "3a96fbf5-cd79-492f-9b3e-50bb7f6d9be0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448453, "uuid": "8ae15748-91f8-4d41-b594-b136ab843cae", "value": "300f73b9997fc04aefac07b67f46d90a4ba6f919a32dfc0d86ffa52933a24d94.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41bcd3cc-955e-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1786436748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436748, "uuid": "803d2f6e-2255-4357-b08b-a0a9c35edf12", "comment": "Malware payload (ConnectWise)", "value": "d60faab06fd2a96468f60d9d03ddede2", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436748, "uuid": "1593cfa4-0529-477c-ad47-8e6b72835577", "comment": "Malware payload (ConnectWise)", "value": "302f4b1ccf1808fa57fd30f4e8e2723b283fc8a1d4fa86267d7d11183ada2715", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436748, "uuid": "3e023c0f-e165-4805-9a9f-e7b44e2b7285", "comment": "Malware payload (ConnectWise)", "value": "be9e5115a8d1dba09a90c7dabd7f4eb9776a069b", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436748, "uuid": "fa0d0f7a-1d5a-4418-891f-cfbcfa956cc6", "comment": "Malware payload (ConnectWise)", "value": "2038db40095c6dc438375790e057f9d38fd8b47e3d91749ebb56120d24fa1c3c1668399b719006d9b6f42270eae026ce", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436748, "uuid": "6c43d30b-03b5-4077-bd87-8462d54530ba", "value": "T141A61211B3D291B6D4BF0638C87A53656B74BC008766C7BB6394BD692D32BC08E32767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436748, "uuid": "73c1982c-bdfc-42d1-8725-d06a3b6e8f43", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436748, "uuid": "2c334ec9-65a3-4870-847b-371b0cb4734d", "value": "196608:GfefPKeq5KqDBCDkSt7QEUeq5KqDBCDkSt3eq5KqDi:rq5VDBCDx7QEZq5VDBCDxOq5VDi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786436748, "uuid": "279ae33e-3268-45e1-8dcd-07cfa62661c6", "value": 9615851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786436748, "uuid": "8a2ace80-5401-427d-b6e5-adfbc04b6179", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436748, "uuid": "787e277f-6219-45d7-b067-dae24a08e101", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d70c753-9567-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786440526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786440526, "uuid": "fc387744-3ce6-4246-b148-933fbbd85572", "comment": "Malware payload", "value": "583ae9efc83b9d01e87b7d8f66f477b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786440526, "uuid": "0836319e-f74b-43f2-9d89-c84485821243", "comment": "Malware payload", "value": "30a27b163efd57243b2f5eedb1d0eb59deda6d9e0e62bee01863f210373917c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786440526, "uuid": "7482923c-446b-4b14-ba64-aadc4b66a04f", "comment": "Malware payload", "value": "1d3909134a7c2161e7d882a189026ca16c4ffbe2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786440526, "uuid": "0afadf55-b346-4e7e-bc52-c3bfdfddc0a1", "comment": "Malware payload", "value": "ce24266cb05a8d8312a8730432d7afd36dd3349d327626ae80e49b61e9790f6c61a7f54f653c676f938368d12bf67392", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786440526, "uuid": "3960a745-ff01-41e7-9dcb-ed667efeae32", "value": "T12754AFB8F58B7E3CF4FD9A9B83393C17B165E0914692FCAE1092F637DA1F1160A24584", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786440526, "uuid": "88177b15-9cc3-46a3-9baf-897d2ac1c45b", "value": "3072:2yt01HBqK0/VcNzDiSVRe+S5vFsghov//aV5N9JCFkvIJUZ55TU1gyvw0x42YQ:2pht0UpVRexvudS5B1kn/x4I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786440526, "uuid": "16123038-0722-42fd-92fc-3cc17e245bbd", "value": 302196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786440526, "uuid": "022aaa0c-89ff-4264-8826-b7f7061974a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786440526, "uuid": "b8342169-a237-4f62-8cc1-87a2237a28ff", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e208bd61-9562-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1786438735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438735, "uuid": "6d01cca9-5d65-43fb-8ec9-368473154589", "comment": "Malware payload (XWorm)", "value": "2b8d79b7116a8b889ba0220d17737dd2", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438735, "uuid": "bafa320c-2ab1-40cb-a9de-4a24aef527ab", "comment": "Malware payload (XWorm)", "value": "30b7576cc070132358e59dbbbad3e912e656719c9b3a7047b347aaeb33ebd891", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438735, "uuid": "e08dbd2a-dc9e-4cd1-ba01-ea6518336fef", "comment": "Malware payload (XWorm)", "value": "dfabfb6490682a92e03d957404663138b789143e", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438735, "uuid": "d3a49808-02d3-49bf-8d18-f100e376f712", "comment": "Malware payload (XWorm)", "value": "b19d80f6d4cb76c78de03a21bcf0117d9f243c2700af16dbb4e5d0c878cef0b347e8b69451c0b54fcc476740eb5a448d", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438735, "uuid": "f0b1b07d-1007-4389-bfe9-05523d1a4fc0", "value": "T1E843F87E2E08A378C4AE7E17AD273BC43100144E66D6BB9FEA658E44FC614DED101A7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438735, "uuid": "bd89ddb5-9cf5-46fa-91c5-fa1ea928be9e", "value": "192:ZXONW4sWWasWaUs/sWcRLIygyoLcCwAWqKoT874CrywJlkxCI8wewbCJ/SWT7+wr:t1zagMN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786438735, "uuid": "59008b49-6649-4ab8-97b7-11055f83b1fb", "value": 56271, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786438735, "uuid": "77ae40c1-e2ce-412b-93a6-61c48e82f46b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438735, "uuid": "c43ee5aa-9693-41f1-81ac-cafd4ed5c1b5", "value": "Halkbank_Ekstre_20260607_082357_541079.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d9c9249-9591-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786458646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458646, "uuid": "25409e7d-aad4-4d70-9001-5ee4330fe6af", "comment": "Malware payload (AgentTesla)", "value": "75df45d421023368fc7d41b56b574382", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458646, "uuid": "56686848-bf0b-419e-b912-302b4d9a0fc5", "comment": "Malware payload (AgentTesla)", "value": "30c2a3fb1fc0672f3024104eac51ab2411d05775176595da1d0215fcf65b0887", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458646, "uuid": "c1448428-4dc8-485e-9ab0-0709bc3a2e80", "comment": "Malware payload (AgentTesla)", "value": "164df369befd9775b67a8da4566eee18bae249e8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458646, "uuid": "ed8b9068-9bd0-427d-943a-a1b155e59d99", "comment": "Malware payload (AgentTesla)", "value": "537fefe704c64db9f78b6939b0d50f83089b9a3381c872cce1cb81ba1303cbf29d539eb9066a4c9821f82865fc5d1a09", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458646, "uuid": "9f33dba0-153d-47fd-8bf5-80ce2e1e8669", "value": "T19725F4B2496684C3CB2A5050FB4BA3B4C129856F8D7B56DBB164EBF211D9ECC081EF35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458646, "uuid": "9ec6a0a2-7ab2-4a75-960f-8fccd80a98a4", "value": "384:9gB3YjliQY2K5gCSrcSEMSEM4bayAM+IsF3:96MA0w3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786458646, "uuid": "86c90d5a-a16b-4a0e-bd58-252091daee1f", "value": 989279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786458646, "uuid": "594672aa-9a3c-49b4-9ff9-648920d32c3c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458646, "uuid": "e79f6523-1cd8-4906-9faf-ba1bde77ca14", "value": "Orden de compra.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2b4ee89-95d8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786489363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786489363, "uuid": "9cbe4256-db26-4624-a788-cb8d61fe7ada", "comment": "Malware payload (Vidar)", "value": "4e451f61d40dfe171af4886ec19d3071", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786489363, "uuid": "f421e05c-0161-4983-8db0-bc0bbbec4b44", "comment": "Malware payload (Vidar)", "value": "31b45f6307b9dbe8bcb15ac7bd6ad44e08cb5fa9a3da0f081d415435618c4539", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786489363, "uuid": "cea4631c-fb25-4061-8c9e-3d161931730c", "comment": "Malware payload (Vidar)", "value": "d54b922e07f811fcc37a96bd05b4e40a18ef3cd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786489363, "uuid": "a34fe130-e9ac-43dd-a058-9170d622a7aa", "comment": "Malware payload (Vidar)", "value": "ccef9dd21416630a59d9cc14f3c8d8f830a53f7797bf776112566c482b9c34d03d095f5eff80ca742db5109036296d46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786489363, "uuid": "6d03819a-bd3e-461c-a4f1-b0104bf6b716", "value": "T1C0963B17EA524D78D4A4EB70887B851BB9607C6E473433A70E136EF43F263916E38B58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786489363, "uuid": "9671111d-2c25-4eb1-821d-8d8835a4637c", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786489363, "uuid": "7495f5f6-aa5f-43c4-8042-6dd15744d7a6", "value": "49152:Lrm/0W+6AJifvkTHg8gM1mTnpr01SGdTxEBeyUEJLOuRDXIHgut8rYxfq/D0CQ5n:Lg5il3JDV2qT7lS9VpnsHSQD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786489363, "uuid": "3548f4c0-3aa8-4481-bc90-6c0853aec122", "value": 8770800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786489363, "uuid": "a855cf03-17a5-4cbb-b26c-a71422edd089", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786489363, "uuid": "979b99a4-78d4-44c5-8667-29200d5b1d63", "value": "31b45f6307b9dbe8bcb15ac7bd6ad44e08cb5fa9a3da0f081d415435618c4539.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c71354a-9573-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786445893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445893, "uuid": "dac79be8-4576-46d7-8e1b-8205a8e89fef", "comment": "Malware payload (Mirai)", "value": "82207f39594ae57eab0bf31d1ca680f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445893, "uuid": "2360a1d6-fbcf-4d44-b6c7-838294177411", "comment": "Malware payload (Mirai)", "value": "31c35ea650b304f71419d2c6fd6e13598a8c704752ee0e55e024d74f08b2b917", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445893, "uuid": "a52152c0-dd54-4de7-b815-87216affead5", "comment": "Malware payload (Mirai)", "value": "398555df09a36c6f636a606d39cc57c835f6b30d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445893, "uuid": "77895272-dee7-46c6-a76d-dd941cb49301", "comment": "Malware payload (Mirai)", "value": "bf8b7285e6f2684ed02dfbdbf8b5eeae1a933396bb76ab2a9c853ad316b1bd3db72193d017fcb4b024f61da39280ab51", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445893, "uuid": "9a5b72e8-cf00-41b2-9d11-5de2ed2d8aae", "value": "T1CFD35BC1F98B81F5E84B48716067F33FCB71E5294136DA1EEF948E76CA27942522638C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445893, "uuid": "841cdbe1-bfb5-43e7-b5ef-71d54dfef64c", "value": "3072:ya07/4xgNsSszDi3fgLC3bCRohq+aWTHI:ya07/4xnSED6fX45", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786445893, "uuid": "8680bae7-f960-4586-9cfd-b3267a74025c", "value": 138632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786445893, "uuid": "d3c9acb4-a818-4760-a310-391816740d8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445893, "uuid": "270344cf-e712-47c5-9064-3c51de4f5e80", "value": "sdfjgnjsdf.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94684d73-9590-11f1-bd95-42010a9c0009", "comment": "Malware payload (SuperboyKing)", "timestamp": 1786458362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458362, "uuid": "ed2637dc-a3a1-4bbf-9809-f8205c41542d", "comment": "Malware payload (SuperboyKing)", "value": "8b79ba6603c524df5c3f1d8695fcfbc4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SuperboyKing", "colour": "#4531C2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458362, "uuid": "424920ce-e11c-4865-8bfd-902da8e40d01", "comment": "Malware payload (SuperboyKing)", "value": "31e27b05795af394e82fcb2bed0e57aa2d619397e7186b717c79c849b5419df8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SuperboyKing", "colour": "#4531C2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458362, "uuid": "51bf7f21-82fd-4ef1-9da4-71e2558d774e", "comment": "Malware payload (SuperboyKing)", "value": "7d9a054cf4d9f2be3ce8abedf5e542ad62584837", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SuperboyKing", "colour": "#4531C2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458362, "uuid": "080ca95c-a42d-4f61-ad50-2688d7761647", "comment": "Malware payload (SuperboyKing)", "value": "b96b40f5ad1a1dea9611e84f920cacf96656f4fa6b3f128a91c3f2e0e6be810cd7de3426447215bfaccd637a7aba046c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SuperboyKing", "colour": "#4531C2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458362, "uuid": "310c4164-2b78-4ad6-aa97-a3cb51dc173e", "value": "T175756B43E69585EAC45EC078835BA632FA32B88E4730B6EB27D45B313E66F905F0D705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458362, "uuid": "aa612713-48c8-425d-9f54-a37fdf05a76a", "value": "38612cc5b647dd684299a7527ab12a0c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458362, "uuid": "7fd3df47-a7e7-4c40-a580-1209ea47abb4", "value": "24576:8SwO3b8SrlvDpeCqskU0q6Sm/ZRFR7DrCuFfN+l:8SzbrFDsmkU0q6TZ57vCcC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786458362, "uuid": "cb00b044-0220-442b-b309-2398949f015a", "value": 1624064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786458362, "uuid": "e2feff29-85a0-4d8e-bc09-48efb5e91134", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458362, "uuid": "55ff9182-fb47-4f78-8c51-61136f380857", "value": "31e27b05795af394e82fcb2bed0e57aa2d619397e7186b717c79c849b5419df8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97abb3eb-9554-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786432597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786432597, "uuid": "4bc8c8c5-d4b9-48ac-8686-0582f0c9a68a", "comment": "Malware payload (Mirai)", "value": "dd25dea42ae0e49a5d9f4f56b780d981", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786432597, "uuid": "d8180160-6966-40f0-96af-5db86a747a0a", "comment": "Malware payload (Mirai)", "value": "321e55cd1d89cdc6cf8423a14c9a9074e84d50667bc7dbc6c7e17301de9f9562", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786432597, "uuid": "2a8f9dc1-1c94-43f2-aa50-57af1e0ac76b", "comment": "Malware payload (Mirai)", "value": "9cf727f8a0cc59f52cab104869dc90769504ce2d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786432597, "uuid": "8c9ae46e-01ec-4afb-b178-4c809f0b5398", "comment": "Malware payload (Mirai)", "value": "83e2ed42dc1c0df9b7831a9e2b7001d9b6bc872677cd25b5ba06492608c4b6b98738ca0a615f203624fd8bc4d4181923", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786432597, "uuid": "78dafb17-0a0c-4b27-9045-0ce637f07311", "value": "T10AC31A467D428F13C6C321F6FBAE46583B127B7DD7EA7102E924BF9123478DA0E26611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786432597, "uuid": "b363925d-a315-4fb9-94eb-29773966f00b", "value": "3072:pEL3QrbY8VhODjMluFQeH3VihDfaTRiqCPAq:pEbLDjMkFtVihDwRPCPAq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786432597, "uuid": "cf182d4d-2a85-41fa-84f9-8feb60c447dc", "value": 125824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786432597, "uuid": "84113b4c-5307-4805-ac9c-148123aaaa1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786432597, "uuid": "09739d13-2e5a-4922-9061-9956cd420a74", "value": "data_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee945955-95bf-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786478699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786478699, "uuid": "9cfb816f-2df2-408c-a8f1-89c6602de43f", "comment": "Malware payload", "value": "ec5d3cb6cb0a5a8d5fe54cdcaf5a5849", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786478699, "uuid": "de2eb53c-596b-401e-a1dc-3f3229f15759", "comment": "Malware payload", "value": "32339b63c95448005da2fe6f38f1c2624143f7685bcc2030ad002981542d432e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786478699, "uuid": "048d524b-ca6b-4918-9d0d-c1bb38b786f7", "comment": "Malware payload", "value": "46aa8b53d4fbca45ad4d0bbd2d4e6b6fae3618f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786478699, "uuid": "2e47dbe6-0cd0-41ab-a689-d1dc33b07068", "comment": "Malware payload", "value": "6793714f01e9164eb206b33a36af596b2f0f4b9a323ac910be9e7e843888b979b0232386c84ed42d882ebd827c66339c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786478699, "uuid": "7239fd75-f264-4c2b-a5cf-7630fc12f4e9", "value": "T128165A07AE9109F6C499E735C8B75252BAB0BC4C4B3123D32E60AA782F777D06D39B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786478699, "uuid": "c5407ff4-bce5-48f6-a5d5-0e542b18252e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786478699, "uuid": "9fd30843-4eaa-40d9-8420-a4ea7f61f0e8", "value": "49152:w7Q489Gi8mt617KQnyHKSJM4DqV5IbrRxnSbekG/WA2NlvTkWXwW:wC+tlwtWhT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786478699, "uuid": "5326cf08-70b8-4695-8d0e-fa489bf7de34", "value": 4201840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786478699, "uuid": "5a3c71fc-43e7-4a93-ac82-b79dd0305b25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786478699, "uuid": "c3b291c6-b169-4147-9a5b-9ab9755f1cb4", "value": "32339b63c95448005da2fe6f38f1c2624143f7685bcc2030ad002981542d432e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58269cd2-9580-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786451389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786451389, "uuid": "a3e9e093-a21d-43a2-b626-ac50595ed78b", "comment": "Malware payload (AgentTesla)", "value": "1848fe1fe5814c8eb439ce3036fae646", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786451389, "uuid": "105e6d56-9ca9-4194-a939-fcf10b6186bf", "comment": "Malware payload (AgentTesla)", "value": "32c0e2d4c15d7af5222b34d5a05c7c30c054f003a3881b33284261d9e80ecb61", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786451389, "uuid": "2822a691-8449-449d-a00c-438a5fc55e99", "comment": "Malware payload (AgentTesla)", "value": "2e1dcf447654917347d750bff551be1a3cb58acb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786451389, "uuid": "b1c786e3-0f17-4252-a17b-0f6b038b37a7", "comment": "Malware payload (AgentTesla)", "value": "97c5ec04435870e5f95d2bbd21bc6c36d2aef5c31716a729b64ae210213529425d0b84d65020a7a93d0af84eadd67d45", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786451389, "uuid": "02b05726-4829-4f97-a4cc-db8678c14eb5", "value": "T102E5D3511788AD327321AB9C563AEDF0DA0A615315C6CF12306CF2587B2CD1BA76CBE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786451389, "uuid": "139c1582-b140-4191-a37d-f85d0fee9ef6", "value": "49152:a+euW7pAnVZpsVjvwCfQVpyIuANgFNEQiiaZHMFB+6ABgFWBGwF2EDByW601pbmv:0jpUv8lQVpjHiEQi12FBkXwwF2EDwW61", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786451389, "uuid": "5f2bc149-bad0-4421-aa28-be541ddb2915", "value": 3021862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786451389, "uuid": "937cf267-bf8c-444a-9cd9-d30c6c1122ce", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786451389, "uuid": "7f6855a2-7e83-4732-8f56-7b308594cbd9", "value": "RFQ.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dfb3c62-958b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786456016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456016, "uuid": "bac304a0-d222-4087-bf16-2380b8b94d72", "comment": "Malware payload (Mirai)", "value": "b027bc1e922f55f7c05bc7479c0da222", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456016, "uuid": "f924cea8-005c-4ba6-967f-3479b2dea2bf", "comment": "Malware payload (Mirai)", "value": "3336124beee46cdc5beb66dc86ee7bb13a7442a1a9240e8ee2ea499533c83d18", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456016, "uuid": "02e7c912-a365-4c55-8dba-46a5378a5df5", "comment": "Malware payload (Mirai)", "value": "0a3c0f7961c622a87124d9046db4cc6698d022b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456016, "uuid": "c9e004ce-80af-4c58-82de-4a6a1f7bcc57", "comment": "Malware payload (Mirai)", "value": "c2e4b4ebb48b0677f2f7d262fc6ac0eba790210c1984f70b8ce1138b0f5fdb8221463a26144976f6d57083526de786fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786456016, "uuid": "4b395881-d6f2-4035-ac13-33c1cb6291b8", "value": "T1C1042945F8815A17C6D612BBFB4E428D372A27A8D3EE7103DD255F21378B96B0E37242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786456016, "uuid": "d08e878f-7091-4428-8bb7-89d521bf0889", "value": "3072:5xFuzOREzpKeNFLncVfe/nCir4WJ3cVMJnnXC8MiQq:wEEFckP/r4W1cVMtS8P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786456016, "uuid": "26bf7c32-5ef6-4ac2-8ecd-ba2a1e2b0e34", "value": 183040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786456016, "uuid": "ec3aaf89-c3af-4599-b108-6573e384f735", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786456016, "uuid": "6b16cb03-ba2f-44d7-b06b-2f843a856d2e", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26a82e39-9569-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786441427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441427, "uuid": "65fa1f4b-839e-42a0-ae37-81e8fa477602", "comment": "Malware payload (Mirai)", "value": "79185ea2e0762d89f06ee5d11b1c1245", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441427, "uuid": "f3e2c4d9-8022-4f09-908f-8a65e6afd30a", "comment": "Malware payload (Mirai)", "value": "33a3d1d5027cf7c784a484b9f6aa53b008311af7a5c9a9878bfd93981b9068c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441427, "uuid": "a0fc86c7-ee65-4af8-b39c-c1d84bb44cd3", "comment": "Malware payload (Mirai)", "value": "1179bfe62978c8fb86eefefb5296d2d6065389c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441427, "uuid": "cf58852b-60b3-43a3-a5e7-e6332badc10c", "comment": "Malware payload (Mirai)", "value": "00bbd8f36f3ba6b4b37cf57d78e35d35b84d0bcdc1a6b19707591f95a5796065dd5e03bbeff0f51dacc1e9e692cc357a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441427, "uuid": "b08d0a45-bac9-43dd-8d15-ada901951647", "value": "T132146C16B98080FFC496D1781BFAF43AE931B0AE5238725B27D49F662E4DE615B2C740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441427, "uuid": "c141b6cf-d3ed-41cb-bd2f-2e7c99d18153", "value": "3072:G+wyfortJ8WzCKbh8zpBrJfUAGYAQCznl9Y6vyA1vWzJUUXEQ7obj:DwCortJvzCldmfXv+OQZo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786441427, "uuid": "70215457-61ba-4273-b89c-1ecf3181c61b", "value": 207528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786441427, "uuid": "f19b2fe6-3648-45d6-9083-d906cd5cb913", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441427, "uuid": "9a39f197-f9e8-48de-a0ab-85b3fcdd9d48", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd90a4b3-95c1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786479530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786479530, "uuid": "e5233a9b-fc01-4782-b516-13ae115600ba", "comment": "Malware payload", "value": "48e1750769a9007d3b7ef232d9633ad9", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786479530, "uuid": "1c508405-6f16-4b41-ad9d-b8ba692787c9", "comment": "Malware payload", "value": "3444514a54d56616b0a9dfa070ff48f33695386eab351843a6ec8662bc9e7d15", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786479530, "uuid": "db9d7140-11f7-44d9-98f5-a6ee3822d7fc", "comment": "Malware payload", "value": "f4fc53fcec034eccd0755a6cae66fbe336297791", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786479530, "uuid": "0f5b9186-adc0-4c76-832f-dc907cc4f9bb", "comment": "Malware payload", "value": "c11ae58ef06efae19a3216cf511f1eb321ab1bafbfe68d9a621ba66638f7bea6a9ad5bf567ebcb0606d799701faf7d32", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786479530, "uuid": "77bd1825-e96b-4ec5-a956-155adc91ac10", "value": "T1D5D54A07BE9048E5D4AAE335C86A46517A74BC0C8B3133E72EA07E782F727D19E75B44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786479530, "uuid": "cef0807f-3cf6-453d-b02a-da6b214e9057", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786479530, "uuid": "7eded2da-e7e9-4a2e-a459-b6a40e9260e1", "value": "49152:uCXuIg4Tq1BqAYXKKMRC6cSqYmkkxE7nlNQ:uXR2ABmVgnlNQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786479530, "uuid": "496df853-82e9-4a04-87c3-358dcb22bf2d", "value": 2750320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786479530, "uuid": "8488dd9c-e361-4aab-997a-17e529fcc373", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786479530, "uuid": "22f4d987-915b-435d-89f2-6f0cf29374d3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9939626-956a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786442157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442157, "uuid": "344087fd-1032-48bc-beca-357566879f51", "comment": "Malware payload", "value": "b450425451381a3762d6d2bf976e592f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442157, "uuid": "8cd58976-f862-4f66-81b8-4b219c4a2e5a", "comment": "Malware payload", "value": "3471342f90683648790f2def10daeae6f75c84eaa3b00026005cdd07160128ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442157, "uuid": "a2b940a1-9414-43b9-bc07-d88b82de2d61", "comment": "Malware payload", "value": "a8da7501a8d4e8c1d236e68a1306cd974b55559f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442157, "uuid": "910fd039-3709-4bae-91b8-473c3172fca8", "comment": "Malware payload", "value": "37a6df3c2ddc8011642f8858b544796c4b20871c7941808785a5dd3a953584065f7abf5901051de7ee8ffac43d47a45a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786442157, "uuid": "56f98509-a0f8-4922-8966-70656f97c7ef", "value": "T1DFD52399F8B72270F432C3FB468371ADB11A775586A15D9732CC6B105E13A182CBB3B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786442157, "uuid": "e8a89a1a-f1cc-4798-8844-f9a7e5fd0419", "value": "1799eb3c1092391ae174afa4eee4cba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786442157, "uuid": "93db2220-a8f5-40f8-8e1e-6367015924cf", "value": "49152:5p64X6stCwzH3BgJR3Im0z8XiWO3TY/oL9Ome+iaa8Zy293kxq:5E4XQwT38RYd8XiW7/oZhJg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786442157, "uuid": "74ddb203-9739-475f-8767-7a4b1da673c1", "value": 2970624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786442157, "uuid": "89ed280e-45ef-4691-995c-b5f531af2cc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786442157, "uuid": "bd015799-935f-447a-86b0-4d6c62a70e41", "value": "gM9anpOuZNKX8zHj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1d20336-9587-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786454653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786454653, "uuid": "25f20a7e-428a-4742-aa39-336f52d3b60d", "comment": "Malware payload (Mirai)", "value": "42396cf448e17d7e270ae99a79187a7f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786454653, "uuid": "7e8d52b9-b9ba-45af-b1fd-dbaa32d2810c", "comment": "Malware payload (Mirai)", "value": "34803f07363342b0bdbce187af0d0aef13e7a65ffd42c8b4e0b304765cade633", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786454653, "uuid": "9cf918cc-023a-45b8-9007-d34aa1902307", "comment": "Malware payload (Mirai)", "value": "db8492772da5e1e501c2c8bac9842d843e5761b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786454653, "uuid": "f6756505-0be7-4045-b6f0-dd75d4d587f7", "comment": "Malware payload (Mirai)", "value": "7efcdd08b5335fca92a2b14b98eee4b55e0d67525a107b7acff407fb4bf414a31314848fbbf48310e6c76283ceb3a8ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786454653, "uuid": "97a7dc85-1e19-4a4a-892b-259dbdf2cb0c", "value": "T18434090AAB610FFBDC6BDD3701E91B0625CCA41722A52F763278D918F94A54F4AD3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786454653, "uuid": "a4a071a6-bb76-4688-bf84-c1bdbd0a26f1", "value": "3072:dWeFhUz6KoMcyNG6AuI2w6S8ruTt6O4GphfZW1gzEwX:geFGOpxy3AGFrgtu+Y4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786454653, "uuid": "eef87612-5838-466f-9ba9-f03479c79b8b", "value": 248548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786454653, "uuid": "033f8ab5-e4ed-49f7-9719-bfd7c44ba179", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786454653, "uuid": "f462a6b6-ebc5-4bb2-9196-cad4a9dc92cb", "value": "34803f07363342b0bdbce187af0d0aef13e7a65ffd42c8b4e0b304765cade633.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d46d675-9572-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786445465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445465, "uuid": "fd637cf0-d8a0-4f55-b7e4-4a381581dc03", "comment": "Malware payload (Mirai)", "value": "d1fe3a4bf37015559e99b3d630417f4a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445465, "uuid": "f6db40f1-aa0a-46e1-ae8a-30e1b8da99f6", "comment": "Malware payload (Mirai)", "value": "34a7a0c034006b793876421ee00f70a5318a65b15837f11e77d4f7d5e7b33ac5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445465, "uuid": "283d1e6a-d649-4473-a9a4-0be7da46b4d7", "comment": "Malware payload (Mirai)", "value": "5855f962ffb75bc6f7bf8b00cfbb9926c676fc81", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445465, "uuid": "3439f88f-8c59-4a1c-8f9f-beba04e8f994", "comment": "Malware payload (Mirai)", "value": "a67d12ea406720f140d977c4009df2dbba87f6feab0c862abb5b12409953e7741b51fee72ce10a1f714e47562f179aa3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445465, "uuid": "5f135b4f-a4b1-43fa-9c78-994997f5ea23", "value": "T193144BC3F900DDBEF80AE73788134905B130B7A214925B37725779BBAC3A19A0577E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445465, "uuid": "91d9c5ec-ecd3-4084-8b56-9e97a176e760", "value": "3072:Hrf2NLkNC/kdii3fa3uc+AEhQvB26og/kmugqqV0jbiRLzIewzyiQ3Xlr:Lf2NINC/OiYRhQvU6qbgqWLz6yiQr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786445465, "uuid": "cf2b4c77-53b1-4ec4-8435-b7a872f34841", "value": 190720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786445465, "uuid": "1e96eb2c-8a2f-4925-a35e-d825a0556951", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445465, "uuid": "b0ffe1db-c6cc-4ec6-b83e-c730ac64a772", "value": "pm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04e59989-9561-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786437935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786437935, "uuid": "1eb06df0-1f24-4978-9173-8ba70f6abcfe", "comment": "Malware payload (AsyncRAT)", "value": "fc59fa0c7997db7334b9c1bde92b95bc", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786437935, "uuid": "12181a4a-01d1-43e1-b5cf-a46e5afcb5d5", "comment": "Malware payload (AsyncRAT)", "value": "34bee5e03bcbce36925e833b9f147c1e58cbf796f9a3dbe8f1d6d22adc639920", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786437935, "uuid": "70eaf3f4-8a24-453c-ba9b-f6d06675462f", "comment": "Malware payload (AsyncRAT)", "value": "58fa0fe247da4697f3ec7b14c177cb1e05313898", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786437935, "uuid": "f03d2ff2-96b1-4097-9e9c-5c2114d458e7", "comment": "Malware payload (AsyncRAT)", "value": "2cd4a5d7a4461930903bfac4b6ccf1ef5f1fd6d426a960b17964c46c5919cfc28c09e630f40fe1d1030d8243be85bddf", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786437935, "uuid": "5107ecd1-b6db-4e50-9c42-1a47038b40e5", "value": "T1E154AFC9D12A04CEDC013BC9D45916C2AF684776977000983BBFAF4A5F2B5FAC05BA76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786437935, "uuid": "a400f348-f07f-4986-bff0-2d66dec68c6c", "value": "3072:c6IwkVjDOZq63KTWHi1Tq7eVihF97IqvJXasuuzI6YJHBnWu5skA:cLwI2ZqdRwyQj5Qsuu/eHUl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786437935, "uuid": "37ac1b27-d95d-4b5a-b551-02487c094117", "value": 301244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786437935, "uuid": "89e214a1-33de-4eae-93f1-865c2dbfe660", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786437935, "uuid": "a0715b70-5159-40f4-8d14-e411892d4bd2", "value": "signed contract.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aaa57ed-9573-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786445810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445810, "uuid": "4d96667d-dbfc-449f-b9ee-3d6ab3fc8221", "comment": "Malware payload (Mirai)", "value": "dd54933c5aebc26622d638dd3b2adebc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445810, "uuid": "37fd229f-f408-4e30-82ba-ce0c860095ac", "comment": "Malware payload (Mirai)", "value": "35910e31e5fe406caba782246674a563b111d42e80a4b71b7996b2b2858d71ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445810, "uuid": "31a0880c-02c3-4afe-a65e-0ea26506e6fe", "comment": "Malware payload (Mirai)", "value": "769d55acb6f5167a9eb8cdd9d6e7dae75fac65f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445810, "uuid": "955a2bc3-1a9a-4586-91c4-99506c3dad09", "comment": "Malware payload (Mirai)", "value": "877c8f351ee70131190dc93a7a530f9afa3ff5ea7d8a2046f7b951289c9202a207cf126385e9962f6998691aa0845cdb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445810, "uuid": "d41fa3a7-c419-42fa-8196-95ac79de44ba", "value": "T1D024C70E6E228F7DF7A8877447B74E21975923D627E1E584E1ACC1101F2439E642FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445810, "uuid": "82dcac9d-8295-4ceb-bb08-0bd482ed3b33", "value": "3072:G8y8pLlmY2OyrpLqvH3bWydFF5yENkCG+rfKlfpyzCBVJE:G8y8pLlm7IvbWyrF1WqfKnyOBV6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786445810, "uuid": "ee13f3ab-05fa-4cb4-8119-2f4f8574cf9e", "value": 227804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786445810, "uuid": "f2539b25-fa30-47c7-aef4-f829a695d5bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445810, "uuid": "af1dd38f-57db-47bc-b70f-9bdc88e42493", "value": "sdfjgnjsdf.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "392a42e1-954e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786429862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786429862, "uuid": "0b641b24-b78a-4bbd-870b-5a7f47944305", "comment": "Malware payload", "value": "7d5e111aee9f203aac25af7e958eca3c", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786429862, "uuid": "b5804671-d1bb-4b3d-b7b1-8d6487dfa560", "comment": "Malware payload", "value": "35922c347242ed888c6f47e1536f13156a6d67a323e736c6137736ad3006f3bd", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786429862, "uuid": "c9151c4b-f86d-40e2-9563-f66cff73a916", "comment": "Malware payload", "value": "73581cc2601930f232cd3fcd8eacaaa382bed5a0", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786429862, "uuid": "df71cdbb-4f76-419c-b22f-6f233d8aec03", "comment": "Malware payload", "value": "bfadcfa1ac316889c679599fc50d38b6ca18bc6b0c06b0d1f8abb11c2b6da5437ba6a44aa9bb4da816ecec6bd1879dab", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786429862, "uuid": "cbaed99e-99fc-46aa-a18f-85987cec07c0", "value": "T1E32402079708957AD2CE65B7B7AF04597B2C2B45FEB0D68670069F8B7A89BC3424813C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786429862, "uuid": "1ffc2069-7164-473b-a1bb-dceba93484b2", "value": "3072:85p72YQA4Lj//QzM/oZqTsDyI9hJYQVR+hJn5PlP4pL8uQO6nUa9p6HRb5wVZG:8niAUbQA/oZqTsD9hy6R6P4pQOIz6As", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786429862, "uuid": "111bbec9-7144-4a5e-977f-f4d1c084e980", "value": 219404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786429862, "uuid": "881ac635-e2ae-4634-ba11-e61b394b5ae5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786429862, "uuid": "9db05668-fb8a-47af-a962-8927236d57df", "value": "SecuriteInfo.com.Trojan.GenericKD.81083938.27283.26704", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbb4e65a-9561-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1786438349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438349, "uuid": "1dfc4ec8-cf73-4264-8861-ad267e3b02d8", "comment": "Malware payload (Efimer)", "value": "3f65f2e2a66c01de0b412b236f23ce81", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438349, "uuid": "a98166a0-6216-4d45-80d1-3632f094608c", "comment": "Malware payload (Efimer)", "value": "35affffe7d3ef594249fd4f657ff616180e864285d89f389c296e51465db514b", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438349, "uuid": "6cd457f3-b342-4f8c-a5c1-874f4bd36b3b", "comment": "Malware payload (Efimer)", "value": "271f04c53aa001742acdae512b6fa179681a0bd1", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438349, "uuid": "35bb6d2e-245f-4fec-b609-becc992bf92d", "comment": "Malware payload (Efimer)", "value": "4378ace742971805a3aab5a14787c43bf555ccd9c847d6e0ab7e3a9a58fd33e775559fac280280b356b8c3dd60d7c2ab", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438349, "uuid": "b873f0aa-0a76-4956-a180-ca87c89c08ab", "value": "T16EE6334CA2D016FEEDB30438DFE51861D935B8764B72C2EF5BA897523D231C05A3AA17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438349, "uuid": "f35f9994-a9a4-4e1d-a194-43cdeeefa79b", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438349, "uuid": "734c7bec-8e18-4bb3-971c-db939034194d", "value": "393216:hxmga8cNJ2BVMMQ91r6eGHRSQPXMCHWUj9cuI3/PGTAI:hxpyYnMM+4RSQPXMb8KH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786438349, "uuid": "68eb6802-7699-48e7-97dd-64260a004550", "value": 14078094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786438349, "uuid": "b86d2a64-2ecd-43ca-962b-b5776a53ed74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438349, "uuid": "9e136b37-f8bd-4165-aa8c-3b32e2ea8752", "value": "composer.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27438462-9597-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786461185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786461185, "uuid": "12daacc0-22b4-4d37-9a95-53fc2645f0ba", "comment": "Malware payload", "value": "89d583f5d486d7ec7123b773ac855598", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786461185, "uuid": "382d0427-ccf6-497a-b7e9-51aae5a9d8a5", "comment": "Malware payload", "value": "3617340c66901935db2cdbb6d2e513b8d772144eb20c57ecc1b7eb588f634285", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786461185, "uuid": "0cf7b77c-21e7-47f7-be6a-b17abb3611d3", "comment": "Malware payload", "value": "bce447b18346221c516db86ba4c9647cb60a1a8f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786461185, "uuid": "faf7db82-c420-4f0d-beaf-998a9698b7af", "comment": "Malware payload", "value": "051db50698d286ba73f5c38a8fc694eb0ae49eaeb5f2f2622157259ac36dffa9dc5d891ba4982c202e0f42b345db7553", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786461185, "uuid": "6148cce1-ad30-4e44-80ce-40be9081a7b0", "value": "T1EED33C11EF0CA81BC9766635A5372798F76078D12174C91277052B2F2AF7232ACCBF96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786461185, "uuid": "1fab19ab-1a1c-41ff-82ff-3e6d5c3a86b4", "value": "3072:6iTXctBs64pzoRiBuAvdds9MzfrIMjfSVzo0l:6iTYsvz1uKddhzJjCZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786461185, "uuid": "2566254d-22f1-4615-aa67-41eefc506f82", "value": 132248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786461185, "uuid": "b28f8b4a-48ef-47df-844d-9b1cca110829", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786461185, "uuid": "e1be8ad9-4c85-4d57-af97-566049ba1ad9", "value": "main.e6500", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4274fd0-954c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786429182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786429182, "uuid": "a4a9821f-6fec-4494-96a0-76742438a39c", "comment": "Malware payload (Mirai)", "value": "8d54450f83e461c31d2b0914a7f8a3fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786429182, "uuid": "47206037-5545-457b-90f9-4199fa211d29", "comment": "Malware payload (Mirai)", "value": "362ee8b988dff0f5e587091d824ae982d50634118873ac485113fe1733f517a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786429182, "uuid": "7e291dc6-c2ac-445b-90d3-c3076db4c75f", "comment": "Malware payload (Mirai)", "value": "1313c4e519d1571d16ddfe1d79e065c8f8e02947", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786429182, "uuid": "0c71fcee-d2f8-4fda-bb71-fa1cc72284ac", "comment": "Malware payload (Mirai)", "value": "2c0ab19519a8df6bb9de625abe1b96bade9daf6ec8164d6a3491307cc5346bf21cb1b0c76d2da2a663583135527c4d02", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786429182, "uuid": "8fb42565-c8c8-49ae-bbe0-5929eecbcb89", "value": "T1C9E42955F880DF61C6C535B6F65D42A873074BB9D3EB72068A254B343BEB86B0F3A601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786429182, "uuid": "f15a754f-f1c0-43e0-82be-b75e7f97ebfa", "value": "12288:Nfx34RWjzgsj0hiuaDh15bzpoj+UZW/ED3SlrNzqeK8pqP8qO:NemgsCu11xzpi+f/EONzgb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786429182, "uuid": "29eed688-2e03-4974-9528-cc64775d9ad4", "value": 669972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786429182, "uuid": "c0a052f1-311e-48a1-ab93-19f54bb3adce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786429182, "uuid": "0112aa23-7b70-458a-b5a4-e225c9377583", "value": "Mddos.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e99100f-95de-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786491772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786491772, "uuid": "eee63ede-4e8a-4d26-8f6c-6b5e0ee1daf7", "comment": "Malware payload", "value": "24c7d4e51834acf9f96d6d061c394e57", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786491772, "uuid": "83a55c0f-0207-41f5-86b1-57b2a38b2b4e", "comment": "Malware payload", "value": "36369c8fd8af54dca7e83b55f421be24eb94af003153bcf85cc2db53826c5ae8", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786491772, "uuid": "c4355404-12e4-4de2-aaca-f1e1dbe575e1", "comment": "Malware payload", "value": "ebb0256496b70e8cfc2b7480b9d679ea1291b9e2", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786491772, "uuid": "812bfee8-9ec7-4f23-8536-9d8b122f197d", "comment": "Malware payload", "value": "dde854d52b5ae598f5abae92e45b48650ac52e85fa4b3b0beba62686a97c785a8527c01c69821e3684defd485ee41108", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786491772, "uuid": "2ef49de8-a4b6-4f7e-9949-bc3ef3ff4839", "value": "T182173335A8BBCE57CCD510F2729F95CDDA96F84A1B2C0C4214B033A31D72A59CAE865F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786491772, "uuid": "8ee5cee0-2a38-4720-828e-76d9dc2bfd00", "value": "393216:urHXqDfaipf0JoZxBjnn0W9h/NNRB7dB6xQW9iRMtGy1a2wU7BSYyNArC:oHMiipsGZzjnn0WfRB7dB/W9ftD1ZwUs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786491772, "uuid": "9fdc3cd0-7d20-474a-9fb7-26a9e09786c9", "value": 18839916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786491772, "uuid": "98d7f2bb-2467-41b8-b891-46416cbbefed", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786491772, "uuid": "a60be252-282a-4085-b5d2-0b777eb8b764", "value": "KBDBASH.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5feb6f8f-9573-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786445818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445818, "uuid": "85ce582f-8d97-4426-a59a-ced6c200b918", "comment": "Malware payload (Mirai)", "value": "673e0d8f3d2c4e16ff5864916af99765", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445818, "uuid": "24d80d10-4ffd-4894-a504-5048146ec35c", "comment": "Malware payload (Mirai)", "value": "366616e42956ae4b10c670eaa93244bc93b8b466651bf66a82104d0c4c46da4f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445818, "uuid": "9fc6a309-fab2-4afc-924c-90bd370bcbe6", "comment": "Malware payload (Mirai)", "value": "6dab3149fd0a286787cb13c0a8f915a623f11e60", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445818, "uuid": "1c364bd1-64c4-4529-8972-dc822762c978", "comment": "Malware payload (Mirai)", "value": "5d2cb0a375a899bc255995f7883ee6fc92c211bedd9db19bdd99c842aabfd03a10e1ad47b0db52a0926e052c04fc8593", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445818, "uuid": "57a72ff5-41a6-44b4-926b-1761be3c0de5", "value": "T1E6F2D131B9CA8E61CFB00E76F97D8001D759CBE6C0E7361F5E448700FE696464A625DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445818, "uuid": "5653279a-a3bd-4e6d-a425-c970daeca98b", "value": "768:QjnBUtB+gqaAfZA+wr7gNhRWRqbLi5xaIPBdEw5i1s3Uozvu:cb6yhSqS5lJdEw5Vzm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786445818, "uuid": "48e30e2b-7d69-4372-a45e-0aebf075002e", "value": 34392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786445818, "uuid": "c17b8e8a-02c3-49e7-b16d-eb6f7c8f7c0b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445818, "uuid": "4c6dea62-4447-4817-87f5-e63fd5a9ba24", "value": "sdfjgnjsdf.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9ae6027-9547-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786427152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786427152, "uuid": "bb77e467-cb99-49dd-bbbd-2702666282ae", "comment": "Malware payload (Mirai)", "value": "7c1309c2a371a9f9d2f250cbc8cd2be3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786427152, "uuid": "ff9d8944-c825-4399-8276-6b2f535a22b5", "comment": "Malware payload (Mirai)", "value": "3687aa4cf981d249fa36cc6ba10c7b3f258cbb7fd0f63a6e6536a7aa69daf98d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786427152, "uuid": "dd070031-7be5-4f37-9b00-c7e06ceec43b", "comment": "Malware payload (Mirai)", "value": "79ced6811afcf526f0886d232021dadbf51781df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786427152, "uuid": "9a2e6bcd-758d-4755-99f2-171a514c6a26", "comment": "Malware payload (Mirai)", "value": "7543bfa57095e5bef78d846c8c116f20487e40e513f3000d6cc24336b694a32d1851ab978ed6affa391489ad6df50319", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786427152, "uuid": "c5683e10-c6a5-46fc-a515-5b078918eb1c", "value": "T188630A96B8818F25C5D5037EF92D118E372227E9E2DFB2229E205F203BC652B0D7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786427152, "uuid": "7a42f78e-22e8-4cd4-b10c-b8f66d5e91d8", "value": "1536:itnPsVkFxV8xk6b5VKLNXduAlCjFlIr57uscvIGiojd70k7h:VqVMkWV8PPX9Cjd70k7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786427152, "uuid": "8ac5f083-b323-4708-80ac-908c902f5062", "value": 66864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786427152, "uuid": "a71697e7-9c8b-4008-82f1-7a690db14570", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786427152, "uuid": "bb6b380c-d9e1-46ee-96ec-2eddda415388", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "584161e6-956d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786443228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786443228, "uuid": "021f0d63-3988-4b29-bbd3-3cf390af34d8", "comment": "Malware payload (Mirai)", "value": "b415fa0f94e569eca09fe664e04b56f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786443228, "uuid": "03727747-c809-4d8d-95bd-796798b1ea44", "comment": "Malware payload (Mirai)", "value": "369194a0cfbe5f3524dbe1f3f9726547cbe6bc62a266e8c07e3f14409c78a621", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786443228, "uuid": "3268494b-928a-49d5-abb3-65fd6ff3537f", "comment": "Malware payload (Mirai)", "value": "73963b4a4f3944608464306f476e6239db43e4f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786443228, "uuid": "79a1dd5b-e9a7-40fb-b843-f82e78446c22", "comment": "Malware payload (Mirai)", "value": "49038b7fbb8981e4b4bc73cd6361c682262cd9addcb2b7b92ac2f7679afcf2fc1abdf33d5efd61b614c781dd9889044b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786443228, "uuid": "25f6eb2f-b513-4423-84a9-a3a2cfcb3ecf", "value": "T19C948D12FAA2D4B2F05240F1121AA7A2A772D9353027D997D3E61D78ED74AC0C36937F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786443228, "uuid": "bbc59976-8d69-4f18-a5c9-de871428488f", "value": "6144:8m9gqyfqsrby2I056/xo6rQOw/hhEcCje0P3z8XihvM:8qg9I05t6nghoje0V5M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786443228, "uuid": "32fadd47-a13e-430f-9d18-355d02ddc514", "value": 424328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786443228, "uuid": "c450dd91-c032-437e-aa02-f54bbec348d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786443228, "uuid": "0b957d43-21c2-42e4-99eb-b9023c4c38f3", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de7a3122-9562-11f1-bd95-42010a9c0009", "comment": "Malware payload (LxBaseRAT)", "timestamp": 1786438729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438729, "uuid": "5270ed02-9553-4dfe-8d11-1758dd06cdb3", "comment": "Malware payload (LxBaseRAT)", "value": "06dc9754d35a4ccfbc606d0fd68cc1a4", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438729, "uuid": "19ef4b6b-5495-45b1-863d-31978391636c", "comment": "Malware payload (LxBaseRAT)", "value": "36d4fc25f2a14f4912b4a72523dcbea44188753fb42acb8e53fd0a6a6444af1c", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438729, "uuid": "25788c53-085c-4898-b08b-b1c004da6ab6", "comment": "Malware payload (LxBaseRAT)", "value": "998c65f58ab18b105401b6801422c5f7230fce37", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438729, "uuid": "4b8acf51-bace-49d0-8b71-5185d2292cc4", "comment": "Malware payload (LxBaseRAT)", "value": "598b6f80c47248d9530e2bf41f8bd5e9ebf38f6fe974c57044c6b457692184d217a71a7f1976fd93f54b9b2931f8c66e", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438729, "uuid": "666163bb-b2ab-40e9-a42d-9627ebea1854", "value": "T16F757DC2616E14A301DDEBC4DB1A26CA7FD9D1622D0436393B9C5971AE83B7730A3778", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438729, "uuid": "b26f1e4d-3df3-4bb2-ac99-ee15aca02943", "value": "24576:dUZageoZsA3pxu+dJ9TkEfRL4BdF5TEYaA8+nAxz/B+renoUEjzjJ:dwa+ZduI3TkEflg9TAxz/kr02Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786438729, "uuid": "c34b46d0-9d29-48e4-a634-17d33dfba91e", "value": 1552120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786438729, "uuid": "6e43fd11-6537-4671-8161-cfdebbc5955c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438729, "uuid": "74e24475-e6a5-4924-b1ef-46aadd47ce13", "value": "Sat\u0131n Alma Talebi Yeni Fiyat.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cf441cd-9534-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786418648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786418648, "uuid": "1b1e351f-03c0-4ecf-b7fe-47487bc9ad9c", "comment": "Malware payload", "value": "ef39c2e03abaff5398203b2280d9a1f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786418648, "uuid": "fdf14c4a-75c5-4f98-87f7-bdff5848129b", "comment": "Malware payload", "value": "36eb1d92a73d4647f314ef8c17a92d12bf4286c497054462187cfcdb0fefe815", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786418648, "uuid": "db4c6a42-504c-4ccb-b744-7633f5378e6a", "comment": "Malware payload", "value": "31f1d9f4d7fa65f3e0c0e7c445746103dbaa4549", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786418648, "uuid": "73449317-370f-4344-8cc4-0372aac89cbf", "comment": "Malware payload", "value": "0a1f40e8f868efe5f4f8a7cd497c07dd3f717d651e96b2c8052d461f84179e51bd83b0f658f210e402de2ba0a6194404", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786418648, "uuid": "7f465be5-18d5-4462-8d7e-c25df9c5cc7d", "value": "T111286C43A2E751D8F0BBD17497E65323E932BC490B3469EF12944B312F72AE0A779B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786418648, "uuid": "c4d10e2d-28e3-4a5e-926e-9d7c64aecc7f", "value": "fd6f6d07cc33ee9a2b65bda58a07bb94", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786418648, "uuid": "ef06db12-a7db-4847-a164-c18cd23717fe", "value": "1572864:7Za7hmguP2nG0/Vyv7UhgxIabc/x7Awby:7Za7hmguP2nUOnAwby", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786418648, "uuid": "22a12a08-66d0-4db7-96d0-4e4f3c855888", "value": 97852928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786418648, "uuid": "9fe1e53b-64df-4bdc-b81f-5a8c611a57c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786418648, "uuid": "56aa9c2f-1bf5-41ac-935d-1cb90fd44941", "value": "app.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b96d1b00-957b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786449404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786449404, "uuid": "c5a07ac7-60b2-41b6-9985-0c368c533f97", "comment": "Malware payload", "value": "40433bfdf3ae8b0c2033ea87f8879595", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786449404, "uuid": "aab44c5a-352b-4c27-ab88-08230168d0f3", "comment": "Malware payload", "value": "36eebdd18c838a276f92498e4cb23b0e1decf3b16c05f6dac1d1a4b02d6bd9e8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786449404, "uuid": "6ce04bf9-3210-4bc5-93cc-98fdf5a88432", "comment": "Malware payload", "value": "8543f982475ccecebcd96c85b2bb585fc7705d6a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786449404, "uuid": "bbb998a1-3e40-4d86-bcd9-4d193cba6263", "comment": "Malware payload", "value": "10da70ca3cce873b5372ad4b4421291a362569e9d037083b41472c785abfe84c984cc55cac9b98397f37f57d8dccd0bd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786449404, "uuid": "60951634-fa9e-4289-a044-a24d85095636", "value": "T114D0229B4063AC12EBE498423639DA0E24403A8B00E93D0DF4E8E4C8EFC840DB2B2B01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786449404, "uuid": "541c2b0c-feec-49c7-b313-71dc96b2926a", "value": "6:QOSB15fW8Y5ApfW8Y5UaZ+TRwCQmf0VO6hOWdGFd:gVfA5ApfA5Ua8dh0V5h5du", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786449404, "uuid": "15972775-008a-43b1-a5ec-a0c0999ae743", "value": 210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786449404, "uuid": "3d39cf3d-dd13-4ea4-b20e-66b114eb452a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786449404, "uuid": "dd975350-d256-47a8-a086-2ff843300ae8", "value": "traff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cf1dc48-958e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786457276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457276, "uuid": "7706b1c4-79c7-4532-a889-04b20191b418", "comment": "Malware payload", "value": "a55e33eb6ab489431ae95ec26b64f3f8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457276, "uuid": "e7542eb0-65a8-4f32-91ef-7041eca1636b", "comment": "Malware payload", "value": "37bfd5cf49ff0024c1f3e6b85166ddcef77b629c6bda05283d79a35052e2b0fc", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457276, "uuid": "1d1c80ee-8ca7-43e2-9120-2e58856fdcfa", "comment": "Malware payload", "value": "9884b7f0b573e2e8a0d84bd89ab50dd71feb35bd", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457276, "uuid": "bfb27911-8bb8-487a-aeda-df28e24e466a", "comment": "Malware payload", "value": "e181147cb732a2aa5ed85acf49520206eced3e7bf22faf93734263aa78e150065d0e86b554fb5cc26309cef7b596a31e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457276, "uuid": "ad9053e1-25e0-447b-b343-8591ebaa495d", "value": "T102B1F38A13921C703DE299673265878C3187B0F756ED6F20F9CCF9A64BACE14E421367", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457276, "uuid": "c25bf3b2-1e9e-44ad-b214-09e439ba7886", "value": "96:BNFbsjjmb3xyrdc+ZNzp3oOUZ5dq8f/R4RZ0SrPWUXVuqPwat:kcnIukWUr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786457276, "uuid": "ecbbbf8d-cdaa-4ef3-95b1-32ca4408108c", "value": 5110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786457276, "uuid": "24bff933-4b6e-4f47-952b-6ec43601af49", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457276, "uuid": "34ed21f7-10e8-479b-98c1-6c1c2260acb7", "value": "o.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "207310ba-9591-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786458597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458597, "uuid": "5da8c448-3cd0-4910-bea4-b1b83fc987f7", "comment": "Malware payload (Mirai)", "value": "8d2c5208a876c7db7b26ac3a72f284d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458597, "uuid": "53b675ef-8ebd-4344-a84b-11445d9e0765", "comment": "Malware payload (Mirai)", "value": "38014a7719370eafbc6a3956801fafe6bb4cbc1232b82e4db78b3babfba8fa2e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458597, "uuid": "fb650958-8071-4124-8c23-207de6e7d2d0", "comment": "Malware payload (Mirai)", "value": "94b0ddcb816c7c657c837fa2e4892a1ca13cdb3b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458597, "uuid": "74ff8c41-502b-4891-8aa2-0276f0c8b13b", "comment": "Malware payload (Mirai)", "value": "40b8f14884da892dff02238a98f1a43283b6f8bdd280440f6fe74b3afe19e962ac841465810ff5a60e60b06805487958", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458597, "uuid": "1409f28a-9048-4ce4-aaf3-fac6c445b2c4", "value": "T1D5045B1675C180FDC9DAC1749BABA13AD971F05E0238B25F6B94AE732F4DF301A2CA54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458597, "uuid": "15798627-8f29-4dee-8b06-f741225d82f6", "value": "3072:bZkK70qYqGSO2WEOdqLXSGIzr7+LVFxKS1OnQ9mvea:bCK7DYn2VMlSgNl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786458597, "uuid": "7874c8f4-f118-4005-a5ed-6841bb612625", "value": 180568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786458597, "uuid": "63c00c61-af75-47cf-a3be-e6ab3cc05884", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458597, "uuid": "3cfd539a-0ce2-4c46-84bf-4316a16e6166", "value": "sdfjgnjsdf.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15163b61-9526-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786412622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786412622, "uuid": "54f4d958-5de1-486d-a125-67bee323a716", "comment": "Malware payload", "value": "a049f59eb561eac6b8605dde2b7e912e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786412622, "uuid": "80ecb359-9881-4752-afbf-87caefb83389", "comment": "Malware payload", "value": "388f63f0eb52acdcf3bba77ec0c470139b5a24b17ba22be2510d3166d739be56", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786412622, "uuid": "35d6a695-f528-4bcc-b014-8739bdd0ebf2", "comment": "Malware payload", "value": "33f4fc97d0b8f82b02bb5e777cca0db6926176fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786412622, "uuid": "10dcd9d6-b766-45d4-844e-52a58ff8d8cf", "comment": "Malware payload", "value": "ee30ceb74ca26297f0e5062855450e217a0b966bf83fbc2a27999b16ffd648e89b3c9e92b3b2dfebc6c237d9efc768d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786412622, "uuid": "d024e970-1bb0-4eeb-b29f-8ed3e9a81137", "value": "T194465C02FA192FA5C920493389B30DA127A26D552F329B56D744F27FADF33464F16F88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786412622, "uuid": "590ede7b-793f-4b37-94b1-32ef3929e2d9", "value": "49152:2JMxWAkWC5z24n/ouwjehU2KCxNB3JNEPzIyvw3zk35ER:2yxWAkWCNn/oujXNE88HER", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786412622, "uuid": "a4a7649e-3ba2-4f82-a3f9-84489cf4117d", "value": 5832866, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786412622, "uuid": "044e51eb-2e2c-4cd3-a934-b6350dd56577", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786412622, "uuid": "f49d1e4d-95a9-40d1-b843-286bfb9795e4", "value": "388f63f0eb52acdcf3bba77ec0c470139b5a24b17ba22be2510d3166d739be56.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6620e3b6-958d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786456996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456996, "uuid": "a9589b2c-dff7-48db-b23b-cef3465c3662", "comment": "Malware payload (Mirai)", "value": "b5666af170d90e26b53ff035304384d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456996, "uuid": "38ab5835-f981-4bce-b940-72a7608e6f0b", "comment": "Malware payload (Mirai)", "value": "38b85457df73dc3a61e5609b017471afc919115aae128ddc20a0acee0ee88436", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456996, "uuid": "d687cbe5-e60c-4e62-bc42-f4373d521cd1", "comment": "Malware payload (Mirai)", "value": "7298b8504080156a7a0ae9a0d16049b077fee214", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456996, "uuid": "27d763cd-bc1c-487e-bc40-b72156ffe5c9", "comment": "Malware payload (Mirai)", "value": "24339773903bb59fecac16acaa94016497a097a6b7ab51ac1e799bdb63c5ea35f7d360a2f3d5f283495cefdd205783ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786456996, "uuid": "04bb7b56-06ec-4f7c-b211-eca6a87239eb", "value": "T1E7A42A61FC419B96C6D12ABFFF5D828C731317B8E2DE72129D194B2063DB85A0E3B542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786456996, "uuid": "532f9e29-c087-4d33-a08a-28fcdbcce393", "value": "12288:+KsUE0L8Uk1w0eDk+cgNgIe5xw2XO2LD945G9mAUz3Yue:dEgu+LclBmAU5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786456996, "uuid": "e868152a-3725-43b3-9349-80d101435cbb", "value": 490112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786456996, "uuid": "035a04e8-8d7b-4ebe-9d0d-377f4ad93c61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786456996, "uuid": "6a41adfa-f88d-4ceb-a776-20b2d6db0ddf", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddb939bf-95bc-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786477383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477383, "uuid": "279a771c-7859-43b4-9ea0-b2ea72d1bd95", "comment": "Malware payload (Vidar)", "value": "7a8111bc9c1c00354b4b154efdb90a76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477383, "uuid": "9760474a-a57b-440a-affe-80bb9be2d27d", "comment": "Malware payload (Vidar)", "value": "38cc2dd3f2b5a2558f78ff1bd56e8cb6364c029379b90ed6cc8fe659537805a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477383, "uuid": "b914583b-4f6b-482d-944b-89a55decea6e", "comment": "Malware payload (Vidar)", "value": "081619391a983498dfbe75f32551e3edf0588860", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477383, "uuid": "ed90c381-88bd-4c75-bb9a-e39f9df3dbe2", "comment": "Malware payload (Vidar)", "value": "f252c466e7ebdf3b7e4eb9024767b7eee8f1aa6b6de2fa882bce17b78ee9b98fc87202cf6c117c2889213dc5f9cc9242", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786477383, "uuid": "db88f1d0-42ee-48e7-b25e-ab2540dee3b4", "value": "T1B7666B07BB551974C095F735847A0285BA74BC8C8735B3E32EA6AD78AF293C25D39B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786477383, "uuid": "5dc6cf5b-2b8c-44d2-8a41-a90afc86166f", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786477383, "uuid": "9ff4d75e-c47f-4c9e-9e81-ef9e222917d7", "value": "49152:BFnmz5YrdwTe6gROOSR6KuBKhYxbfuB0vI7vYua9EqBquNQDq1duvRawhOznAZAN:BA+90RmL2vnuOM6kTmIid/kpUa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786477383, "uuid": "42877079-6e4d-4c1b-b785-8fb640f81fd0", "value": 6669736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786477383, "uuid": "b99f0cf0-1cfb-4735-97dd-bd6233930360", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786477383, "uuid": "64fd9f2e-1093-406c-9bcd-6d829da25513", "value": "38cc2dd3f2b5a2558f78ff1bd56e8cb6364c029379b90ed6cc8fe659537805a9.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b93137c-95c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786480224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786480224, "uuid": "56fefa7b-ea34-4912-b43e-1b0327941310", "comment": "Malware payload (Vidar)", "value": "bcc35919307b0598bbde8924eed9c6ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786480224, "uuid": "6b5e3f30-5d92-490f-b57a-12726d20b346", "comment": "Malware payload (Vidar)", "value": "38d8c50709243f995e3f1102509dbf8f62cee97750fc3f7dcebdf9684816cb75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786480224, "uuid": "452f156c-3f59-4003-8c8b-c5df400363cc", "comment": "Malware payload (Vidar)", "value": "28b9f147704da29e287c2d64a93160d9e4d30482", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786480224, "uuid": "b0a7f8d8-edf0-4882-a248-33606c54c588", "comment": "Malware payload (Vidar)", "value": "a386f6e4214583fb07b195dcc6e11309c1ed19b8618c9ed21a78b5fb37f31b42e2544133e91bce5414047b9aa12ef106", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786480224, "uuid": "9203d455-41a5-4da2-970b-c90f31730ece", "value": "T1A3069D07BE92597AD4ABA33585B642513B3CBC194B3237D32E40B6BA2F327C19D75B01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786480224, "uuid": "03d465e9-c9d2-4231-bee5-14b6350d0e01", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786480224, "uuid": "ec55d7e1-131f-4c51-bdfa-c444c05ae0dc", "value": "49152:R4HHNbM8TqMjRovbpdmdE+4GPGqY7fMHwbxRhkdPpFexd9T1CPsTrk:R4n4bpgdgGuR7f4qDhkdPv69TXrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786480224, "uuid": "895cd078-5a8a-4317-96e1-821af15f0529", "value": 3858952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786480224, "uuid": "5e602b35-0f16-4a24-887b-c3a40df304a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786480224, "uuid": "d929e5fd-8384-4156-b39b-88ef595e0546", "value": "38d8c50709243f995e3f1102509dbf8f62cee97750fc3f7dcebdf9684816cb75.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6c8f78b-9579-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786448514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448514, "uuid": "cd0e4a42-cf48-463f-a637-8275bd4f8786", "comment": "Malware payload (Vidar)", "value": "0566b882e63f506783cf7e119dea3836", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448514, "uuid": "8fbf6efe-285e-45c3-afb2-d873a11cbd6f", "comment": "Malware payload (Vidar)", "value": "38f64adb7bf2f2c9b67c0c3f5b8ec600b238f24b3a9f00b68ccb7fd01978c52d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448514, "uuid": "af66a353-cd30-47f6-bc4b-10adbc1a3f08", "comment": "Malware payload (Vidar)", "value": "4af2e2aab5676ba18e1f08d0aa3053d1d604686b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448514, "uuid": "32f4b0e9-08da-40cf-82cf-ae398ee469d4", "comment": "Malware payload (Vidar)", "value": "a735b1414d7537571e945c1011537c728f8ef8abfafb9033321d081d1aa3b5b20f4db3439ad6b47036bf1880f6085a05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448514, "uuid": "2bbdf0aa-1d0b-4115-af37-f0615ac8887c", "value": "T13E066B47789148EDD0A9B33085E366527B747C490B3627D72F91BA782F32BE06E7A314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448514, "uuid": "12261ead-60b7-4abf-be19-d1f89b14ae44", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448514, "uuid": "7ad61c9f-65a8-4135-879f-bcb7baf4880f", "value": "49152:WBRl38LdHwhTiaDOe3Q3SylqTDsk2tWScTPhf75H9zYhu7xcu:WFBAuP92tWScTPhD5dzYm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786448514, "uuid": "98cbee5b-bac2-415b-a4bd-cddcb00d4e17", "value": 3892592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786448514, "uuid": "2b4f05fe-44e5-462f-83fe-813dac3f0486", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448514, "uuid": "88d227e2-af87-483c-8dd3-fff7b9bcff02", "value": "38f64adb7bf2f2c9b67c0c3f5b8ec600b238f24b3a9f00b68ccb7fd01978c52d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0ce0f41-9597-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786461470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786461470, "uuid": "2dd02c3c-49e0-401c-975d-c3fb38b968bb", "comment": "Malware payload", "value": "9799549d4e2f64f1d213ac79a1903f15", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786461470, "uuid": "654b4ea9-582f-4712-becd-6efca068745d", "comment": "Malware payload", "value": "38fd20715886f29904c3c89f54c570eede13bea677a0214a8c44b754ae8e2eac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786461470, "uuid": "1348c8d6-1b8f-4c4e-ac9e-7ff13f89114f", "comment": "Malware payload", "value": "e414363beb5a2c42af26884a4c3bd224c4654b7d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786461470, "uuid": "d2320790-ee9b-4a5d-aae4-ea27149e0308", "comment": "Malware payload", "value": "1e0b2355b06452438f847e081584301cd63c58f04eacb7bc4e8bac4dadfa000502ee0fe54d87b5bebbcf25898b2cd9a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786461470, "uuid": "513bfca8-dc40-49a0-8427-d0d216106517", "value": "T183D3E61333487A91DF47A83F96C7BE117392B99413518562BB10120FAF76B6ACF0EB49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786461470, "uuid": "4155cf64-3693-4159-83c7-5b7c099c0745", "value": "1536:2fKE78xo/UA5Abb6rewk23p10Nifd62dDvB1ykmgmuxSxGSecnUrpbh:nEwhA+6iwk23p1SifBBB1KjukkSec8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786461470, "uuid": "a373d382-b00b-40fc-9b44-61772543cecd", "value": 132248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786461470, "uuid": "ee7b885e-26a4-4859-8b66-333668f915e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786461470, "uuid": "45e5efc2-83ba-4e2e-8712-fce6d0731b52", "value": "main.power8le", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a18e695-9579-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786448466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448466, "uuid": "7ef7f5e4-c546-4667-860a-5fbc89e58893", "comment": "Malware payload (Vidar)", "value": "ccfd9857945cbd7e0fa8884c2712fcbd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448466, "uuid": "75aab195-d60a-4c52-b3eb-90dd2222a44e", "comment": "Malware payload (Vidar)", "value": "3928f2ae837bff6ae2e00c108517cdb513af4ad2fb7a48d99e7392a959cbb735", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448466, "uuid": "7d290068-6aab-49a4-abf6-ea2dcf9b9518", "comment": "Malware payload (Vidar)", "value": "a71cc57fc0b4def0f3794ba8a647d7c18ecb8591", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448466, "uuid": "86cd2d38-6545-41b9-9f41-5bcab33048ca", "comment": "Malware payload (Vidar)", "value": "3eea4234d33fc7655798a72e1ac4df7aeff18e75a083cf9ac2430b522a7114e57c075391148ca87793fc97656bd1ee7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448466, "uuid": "1a6863e6-a1fd-4efd-a221-b6dc956e66c0", "value": "T13EE58D02AD914CA9C46A5334CDA752527B7DBD084B7623DB2F50B77B2E72BD0AE36340", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448466, "uuid": "3776b099-5ca8-41be-a16b-282ae68cbdf0", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448466, "uuid": "7e492183-7a43-44e0-89c0-8ec641c3c991", "value": "49152:tHiY7OXMtc67v1mo4E9+uBulixs6BMlkMu8BaZvbzv:tvt9h+SMRHBaZTzv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786448466, "uuid": "ad37c3ea-51bd-48bd-8893-361d3162e428", "value": 3285952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786448466, "uuid": "7b98b9a6-b495-4143-9070-ccd81235b5eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448466, "uuid": "1c1b9b8b-8fb2-450c-a2b4-9a3a1ed7755a", "value": "3928f2ae837bff6ae2e00c108517cdb513af4ad2fb7a48d99e7392a959cbb735.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80ef571f-95a4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786466919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786466919, "uuid": "175e2d20-d2fd-4955-babd-d02f4712783d", "comment": "Malware payload", "value": "d1170946ec72c4370b68493c726be1a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786466919, "uuid": "3d5c565b-9c83-4d5c-879c-49e9f98bc9ed", "comment": "Malware payload", "value": "39a6bd1a0de3e86a2ec33fb445459e3dde67a5f0a428d414963c6ac6cb68d31e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786466919, "uuid": "2ace2e26-bce1-4e99-a0c8-f1cec33860af", "comment": "Malware payload", "value": "5751a8cd4ceb0669eb033357f8eca400d74de308", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786466919, "uuid": "8a53d212-37b4-4826-98e6-cbacfdd2d90a", "comment": "Malware payload", "value": "2ad41182d6cc0928445c8cb403d06c236a3af1caac31c6ab48a6faf3f5587f76df61a842614886dca7517d577558f701", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786466919, "uuid": "6d4f6c44-fad0-4f4b-831e-5937bf0c5c22", "value": "T1D1534A12B348FAE2CE902D306081D1B4534E2CE2178679E6E44CF6E57D7361B7AAD76C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786466919, "uuid": "883fccd5-07ed-4a2f-b9a7-d9a9df661727", "value": "1536:U0pBkr6hwC1XbZLWSN6ItaO+/++O4rH4mpdH/M7tS8ri:RBkowC1XbZLTND72LO0Ympq8Ui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786466919, "uuid": "327ef68d-0f31-4704-9a67-320d573ed0ae", "value": 66340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786466919, "uuid": "a7161009-e292-4c9c-a06a-b495599bf17d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786466919, "uuid": "38154de1-dbb6-4f2a-a002-3cd888e569a3", "value": "39a6bd1a0de3e86a2ec33fb445459e3dde67a5f0a428d414963c6ac6cb68d31e.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d154a92b-956a-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786442143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442143, "uuid": "595d5a4b-f39c-451d-ade8-5be29efebbe4", "comment": "Malware payload (AgentTesla)", "value": "ca590fdcce01d33e71e589264b22f58c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442143, "uuid": "ba27cd6f-7714-4070-af2e-31c35b946c64", "comment": "Malware payload (AgentTesla)", "value": "39ac2c4015532e8b06bf54ecebe497ebf2652c1a55e67605fa0c2618c2735906", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442143, "uuid": "d031b907-5959-4d47-956c-1332ab8959d4", "comment": "Malware payload (AgentTesla)", "value": "f04e01a13db38856f3372c6fb9f1959a6bd6283a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442143, "uuid": "9c09af50-ff89-4893-a3d0-6ca632a2f55c", "comment": "Malware payload (AgentTesla)", "value": "1dc66f8b2791f7e821c7c23ed36fabfdf939d090785e786c166448ade814ad066e4157f242eecef3cc7aa2ac37bbab2e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786442143, "uuid": "09a1e10e-c1a2-4d84-b909-758108cbfad4", "value": "T15025611167B9702B446232F3FA1546C6B67D909E84F3588674A9DFFF20322DC626B93C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786442143, "uuid": "de24116f-faee-4d6a-bb97-56dd97dda00b", "value": "384:YQItyfk4LCO2fLeEOdvHCDtlTK6tUzPXIatyhj:XmwMUzi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786442143, "uuid": "eed6d630-f1ea-4c84-8d6a-400cda22c338", "value": 1048481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786442143, "uuid": "ff811a20-a57b-4749-ac00-3fb0904f761e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786442143, "uuid": "4e250a38-8deb-4db5-9bcc-b9a5d9f5213c", "value": "goodthingswithbestwayforbetterplacescomingforme.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e418d8f-959c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786463318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786463318, "uuid": "b1c4e66b-0eec-4f56-a5e2-9a94e69edf32", "comment": "Malware payload (Mirai)", "value": "09d3d871f2b5c61f12c92a41c2382569", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786463318, "uuid": "794d788d-952c-444e-88b2-d53f6d6cb146", "comment": "Malware payload (Mirai)", "value": "39db9469183655f73cb9c7639af70b104fdbaf65bf68ce69a55be0010c5039de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786463318, "uuid": "851c6240-f231-4cfd-a6fa-076578aa2941", "comment": "Malware payload (Mirai)", "value": "c473741a1195244fd2cdb36e5330817b3f4aaffa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786463318, "uuid": "9c1caca1-6370-49ed-9478-3547793eeb14", "comment": "Malware payload (Mirai)", "value": "96779b3c04cb47ed0c9b79baa97c30756c54b07c42d01e374a8c598fcc9979e9c6e4dc64cac4ecfc8be1a374c07174a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786463318, "uuid": "d6332cff-6518-4514-aa70-b7e01e8fa804", "value": "T103A2E1665127D2B1C2F0AE749CBEC3C6558267F172E4306E2F1C0529A69248352FDFD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786463318, "uuid": "cdff18cb-f869-48bf-8b5d-12017347bdbe", "value": "384:R6AsZ+zCGuBCL1nu+nB6/cWBFkzSXfH6+Uo8MBhymdGUop5huM:QAsqCGTdnUBo+Pa+Uo8Gs3UozMM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786463318, "uuid": "dffa2024-6f3a-4a1c-87b1-deb237d2753c", "value": 22512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786463318, "uuid": "608120a8-156c-4740-9bf8-3f1345429b12", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786463318, "uuid": "47d7cc06-abaf-4d33-9873-8721599d2d4b", "value": "39db9469183655f73cb9c7639af70b104fdbaf65bf68ce69a55be0010c5039de.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b52be15-955e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786436818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436818, "uuid": "cbc500a5-909a-41a4-bb26-232718216771", "comment": "Malware payload", "value": "842a78102347ab026bebc72ea4bf4f69", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436818, "uuid": "0790d971-b3f2-49df-aab2-4eee52c30097", "comment": "Malware payload", "value": "3a32b9a6450f39533580b5cbae649e5bdc966f56555ec662c7cd6c53668d20db", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436818, "uuid": "b0aa3be5-ac51-4657-873b-479071fc98cf", "comment": "Malware payload", "value": "7ff2129c660555318049fe978e83734476fef814", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436818, "uuid": "d16835a5-d1d1-4aae-8712-b7d4b8b695b5", "comment": "Malware payload", "value": "7aecd8a89564c68068a4e6e8da60658abd92889db439c45ed285f358833681abb5f0ac9417962b5b205850d5e8ceafbb", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436818, "uuid": "d8cdd796-091c-4bb6-a6e5-4720e5f5e6df", "value": "T19552143C99A0FD948797E6D2494E7D82189D4F2F7101B7143A8C092777C43786C2417E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436818, "uuid": "00a281fd-85d4-43c9-9209-a977bfae9b66", "value": "48:3ageH8pSFFH8USFbO6IlouuuuuuuHC3H8HH8ZySFOH8xPG:q1cEFFcHFCNacHcZFFOcx+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786436818, "uuid": "32cf2044-ba23-4c59-82f9-dd684a47817f", "value": 14027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786436818, "uuid": "276c0465-f690-4222-ad2a-8d6ff4c5b071", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436818, "uuid": "604c811d-e85b-42dc-8bc7-0cfd3abf99e8", "value": "sccsq.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0994ffb3-9591-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786458558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458558, "uuid": "23f66667-37c6-4be8-b8bb-5cfc870f9506", "comment": "Malware payload (RemcosRAT)", "value": "a50d4ee7436779d39c61c1b742c78e0e", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458558, "uuid": "5663ea3d-44bc-4e6e-b9f9-27f23ee7c086", "comment": "Malware payload (RemcosRAT)", "value": "3aeef89c7a52c5cf90c94b874e53cf36bc1ea7ac599ebe7d0d0b63b10e2b971c", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458558, "uuid": "9e3f4c5d-589b-4bb5-81d8-3229166b1727", "comment": "Malware payload (RemcosRAT)", "value": "70cebc3dbbe175d0c829ab2ce717743329f81d03", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458558, "uuid": "d880d3c5-3015-43ca-832d-0a7c1917146d", "comment": "Malware payload (RemcosRAT)", "value": "287cc1ee41c217ea7116bc512ef59eac5716a60e58b78b11ec0d33980725c8d1112e344738d6ed1abb1f7e8dec4d20c9", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458558, "uuid": "1deea52a-cce0-4729-ba7b-32312eb8019f", "value": "T1A81518B223B15E7DA113F151117D8948205CF083E1BE7F9421E5BD9DBC5FAAA6C888EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458558, "uuid": "335a342e-bfc9-4877-8538-0f89243046e7", "value": "768:I7jM2y6tsxezPP+dJM+JuUlR8DStszXyDuFi4CQ42ybmzgaQ+KYiTM60T+1rcxMb:2o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786458558, "uuid": "c3365b63-5c9a-45d3-9d0f-66ea25675791", "value": 890427, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786458558, "uuid": "dd7a6581-909b-4a6c-9659-0e3aff85444f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458558, "uuid": "7bddba09-3a01-48a6-8185-ee9636b5a4e8", "value": "ZD 0811 M012026_xlsx.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbe40e5d-9569-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786441785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441785, "uuid": "f1d0fdd6-2b10-4d3f-bee9-72d01859b410", "comment": "Malware payload (Mirai)", "value": "3a83ca99640ab5c59773f562ecb1d10a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441785, "uuid": "01a46fdc-a479-49b1-bf75-8df543a8fb33", "comment": "Malware payload (Mirai)", "value": "3b1fe29831a42930dc47050d44750772b75c91c70b7cc286b8a4f47e49164211", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441785, "uuid": "d0d05250-44b9-4c82-a375-41fcefa8e5b5", "comment": "Malware payload (Mirai)", "value": "0caf05028ae4aab701e3e153116aed28757ddae4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441785, "uuid": "455e700d-4b22-47d3-acf4-bf4b5ac16c83", "comment": "Malware payload (Mirai)", "value": "48b32647f62e62ae2bbab20235fea094505840d6bb64ac92530e6f1d5dca225c3b3720f4746b026ba8c7f487e256435b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441785, "uuid": "03fd9002-0c8b-4c81-b198-0636c64f85a8", "value": "T19363025DC3114543CAA42BB8A6DF010D7985E670EBEB21BB29118C48B9E7A514FFC09F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441785, "uuid": "622aa468-1650-43f2-adff-754f59a4f3f5", "value": "1536:X8+6+0aHo6td4icSElsCAkjLQnkwwY2CIuSs:XN0Mo2cXsCJjLWTIuf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786441785, "uuid": "21321ebb-eb43-40df-b5a1-edd324c6b9be", "value": 70400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786441785, "uuid": "0e256eca-5ecd-4801-ab28-c926655fc36f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441785, "uuid": "320e7af9-9fb4-485c-8588-8bf689f1c42d", "value": "Mystic.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cbe4a4b-9572-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786445464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445464, "uuid": "d7976894-bd32-4922-ac3f-a08783405a75", "comment": "Malware payload (Mirai)", "value": "cb428f85cb78cdaf52cac7984eafe165", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445464, "uuid": "82446b7e-fbc2-4100-a628-19e84a4a5245", "comment": "Malware payload (Mirai)", "value": "3b4b7f01fa9afb83a6f113ce0a1d3c9a99a3e6e96270fe0bd727132f0e7709fb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445464, "uuid": "90437a31-d3c1-4454-ac32-5cb1f43716ae", "comment": "Malware payload (Mirai)", "value": "7b152c64420ead089285f0b26395121a172146ce", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445464, "uuid": "cf506cbd-4767-4719-a304-44f0c3eab939", "comment": "Malware payload (Mirai)", "value": "f19fc70262515548baabdd08af823a8094152e39761191f6d9c5a34ac0d802b2ecf126195bc9dc44c316b163edd5c420", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445464, "uuid": "d5806e89-b629-4160-9877-17f507a6d82d", "value": "T1A034080AAB610FFBDC6BDD3701E90B0625CCA41722A52F767278D918F84A54F4AD3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445464, "uuid": "4117086a-5c01-4629-b064-cf0ec7f9cf2f", "value": "3072:pACkxbA66IhyQvDqvtnxZEskqLR0yeSjGFSNwd98WE+gW:KCkdZ5MQGvtxkGuyFTp8gW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786445464, "uuid": "78b8e134-688a-4f75-ad0d-4f055e794332", "value": 244356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786445464, "uuid": "15eb58f3-1425-45d6-aec6-b80b99e2edd4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445464, "uuid": "cf1b16e6-fca3-4d74-9195-86b2214b4267", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6d73ed7-9523-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786411604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786411604, "uuid": "caf5764c-38c6-4380-bf18-fdccef4ac70b", "comment": "Malware payload (Mirai)", "value": "2c9b0d1f4acbd47c46532064aefb73d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786411604, "uuid": "61f754f3-a4b3-4405-9ed1-e0bc0a80db1f", "comment": "Malware payload (Mirai)", "value": "3b6902d4973b9a5d54a1812b74f531e53913ac924b590be96cbb57b3fa55f79c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786411604, "uuid": "b4291579-4c8f-4232-a013-2bdcb8383a01", "comment": "Malware payload (Mirai)", "value": "37750cc6004ce8bbcdc9629e0988eab8affe15f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786411604, "uuid": "895f8555-6b8e-4e4c-b437-685cc86c192b", "comment": "Malware payload (Mirai)", "value": "69aacc4b0a04926273effcf433aab9d78d34b6ad0de0932da7d513baacc19917debeff8afab7cb343450b778073d942a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786411604, "uuid": "889a0f28-d23f-4c3b-92f9-e99e9f250988", "value": "T12A13F946EA519B05C5D232BEFB8E414E37136FA8E7ED32319D306FE013826E71A39525", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786411604, "uuid": "303a7e09-e606-4876-a8f0-13b8c07d0515", "value": "768:HknCu0aUfRP/JfFUpNUL0DkmUPjUCXQBilC9wNlsnOaVng4W:HknCBaUfRPB24L0Fgj8BilC6NlsE4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786411604, "uuid": "a5b5c1eb-2e55-4597-a5e0-48aaa5d6e507", "value": 45008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786411604, "uuid": "418278ab-74de-467b-8d3d-c9f113b67a28", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786411604, "uuid": "afc7e59e-8161-45e9-9bee-678f2701ba2d", "value": "main.armv5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa877d63-9533-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786418456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786418456, "uuid": "7b49acec-52e5-4ab9-b752-23b32fa52137", "comment": "Malware payload (Mirai)", "value": "2366a087326e420976dc8b48c53e2eda", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786418456, "uuid": "b7027b37-1422-4e6a-aaa0-f13a20e9c34e", "comment": "Malware payload (Mirai)", "value": "3bd7c189224f478149e62984f08ec3f0f11d233b1dba27fc4b51024ccb51a8f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786418456, "uuid": "8bac8708-e673-41cd-b3e4-32eca26303dc", "comment": "Malware payload (Mirai)", "value": "0413951b465d379c8291b21b50e9e93efa019349", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786418456, "uuid": "d689dd67-e635-41c7-8b0c-bbd3c54873be", "comment": "Malware payload (Mirai)", "value": "0c08287e3a170036b1550644c725eda71468b238d75cef3cd2c734546a2638fda59cabd03ce2bf605e0426768683864f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786418456, "uuid": "0f792452-13bd-4ec1-8fe4-235a306a7962", "value": "T100140955B9C26E19D5C3423AFE0E024D370F5BE8D3EBF3369A141B75368B81A0E6A507", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786418456, "uuid": "ca5ce25a-746a-4ea0-97d1-d3b1b10064a0", "value": "3072:KEVN46EnCZJqa5j5cTl3uC0NUUciaTeFgWsDM2nnHo2BgsVnQWsN:rV+7CZJqWj5c1VgciaCFgA2nVGvX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786418456, "uuid": "23520408-44af-480b-9752-82bf933a427e", "value": 202720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786418456, "uuid": "52291a57-d7da-4934-923f-1e4882bfb2bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786418456, "uuid": "44413fa1-6f28-4aae-9014-7cc4f9499388", "value": "tarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c4dafd9-95bb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786476602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476602, "uuid": "ffcb6452-4d74-4109-aa2d-a172851b8354", "comment": "Malware payload (Vidar)", "value": "55c1449036f0595735e4afe63d918e47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476602, "uuid": "34cba970-c721-44e9-9944-f99a05ac27d5", "comment": "Malware payload (Vidar)", "value": "3c6db61fb9f8608d82c3bc6a3d7d9e7a3ea320c4e88e423dd6b97cf2ead6f660", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476602, "uuid": "430727ff-8c95-436d-9bcc-b9ff9e7af3a8", "comment": "Malware payload (Vidar)", "value": "e9971b51aa7cb77591e3446e84c8bed70a248d0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476602, "uuid": "9a5317cc-9b51-476d-83fd-0776de96dca3", "comment": "Malware payload (Vidar)", "value": "a2477b15a81de3362793df6aedcaa74bc02f4c420e8f5f12a544c966bff0e7c22fd7e122297f16f8027b7962bf1318f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476602, "uuid": "75e9c5f3-e6cd-408b-9d3f-740b4343473d", "value": "T179565A03AF511864C095E73548764285BB78BC8CC735B3E72EA2EEB46F227D15A38B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476602, "uuid": "27afb05b-a962-4a7b-a321-f708a5f3eb02", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476602, "uuid": "ac190ca1-2524-4cf9-bd14-dc51bac1eca1", "value": "49152:iOAnA731K5jqtLW3ncHwhfAV+9Do9Bp3LtryDh7Kw16cGSGJQRiSN/Wih8CCEDoA:ik/W3bebQotOk9ebzeQ8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786476602, "uuid": "3f4cdef2-c4c0-40fb-a0ef-3b9eb3fb8b9f", "value": 6019184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786476602, "uuid": "7630ed82-9a5b-436b-b176-ca8fdb63bc49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476602, "uuid": "296a61af-a2c0-4b69-8da1-6fe38cbe5628", "value": "3c6db61fb9f8608d82c3bc6a3d7d9e7a3ea320c4e88e423dd6b97cf2ead6f660.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "345bb7ee-95e0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786492560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786492560, "uuid": "1317472d-a06e-406e-8783-d1ca1648174c", "comment": "Malware payload", "value": "8bcfd730880f8b337eade49bbafe414a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786492560, "uuid": "e3468e40-43cc-4f33-965c-20a341faa5aa", "comment": "Malware payload", "value": "3caccd1d6ca2aa5970d53d9808a28e6fdb796e8bb0997a3f7a0bf80324a73777", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786492560, "uuid": "286a778d-2724-4d13-8329-c47521cb120f", "comment": "Malware payload", "value": "572f8d63d3435ae7f419690a2ae81d004c3399ee", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786492560, "uuid": "c57cfb1b-0450-4070-9f49-7790df4c3e5c", "comment": "Malware payload", "value": "f2dfd89361645a876fad4bd61afc7e2a8ac0149da6c0f4fd4e8635e2177e461cf8df916cceb94abffe55cdbe1789bb7b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786492560, "uuid": "0d8bcdcd-4650-42ec-bc86-3b345571329a", "value": "T1AE1733771670CC75DC6802BB24DC5AB48FD0C3E1E98E4A829F9E695A640EB46337DE0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786492560, "uuid": "a47c03cb-4f1c-43ab-bb8e-8889dbfea3cb", "value": "393216:bcaPyQvR3gWiA1wfoqgcdDbFPOHU/xm4QXZiPOHQs:bcaqORw5UwgqgkhKgmfQPOb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786492560, "uuid": "9385baa6-5851-453c-a228-cadb8f3ff8e9", "value": 18900285, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786492560, "uuid": "5ae2988a-996d-4a0e-9a7c-9e918cfcb23a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786492560, "uuid": "80277c93-6520-472f-b550-403488ff69b8", "value": "PortableDeviceApi.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0d1d276-9538-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786420614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786420614, "uuid": "e2f8e336-82d0-4681-a2ca-79de1ce14315", "comment": "Malware payload", "value": "f18b5098a2ac319c087464f5f847ebf0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786420614, "uuid": "358b9e93-fe7d-484a-91d5-3dbca2b56903", "comment": "Malware payload", "value": "3cfea141b4229a5d05b06ff1c97d458d30225640562aa3dc04ee0c2d982395b8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786420614, "uuid": "fbf1e356-34b0-482c-b9eb-385b211a5508", "comment": "Malware payload", "value": "dbaf608bd3af56c2059fe266f50b83feb146d4e6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786420614, "uuid": "8a78efe5-d581-4403-abb3-49e051a27fff", "comment": "Malware payload", "value": "59b15d7ff2a8d8fdee8ab89d9803dcf2678099bd7f78bc65e7aa496f306f3e1a774a684451cf54a47f92d308006f1670", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786420614, "uuid": "09bb0515-e4c4-4824-a49d-a2c126691702", "value": "T105C27D966A857C44BDC94B3E4CBD2B1D6DF5C3D1224942AC3D4A3C71DC11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786420614, "uuid": "7508c925-de56-4ab0-9fd2-fe092b91df46", "value": "768:M8vCB+25j6es8RSZ9FYpMSUpi+20qUpi+20YQX:M8l25J4d2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786420614, "uuid": "54fbd79c-d2f4-432c-94dd-80719a3bed48", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786420614, "uuid": "8596b317-af37-41e7-9e3a-7cfda2d46dbf", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786420614, "uuid": "d72da1de-ef79-42c7-b50f-bee4c6e8b37d", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8da8827-9585-11f1-bd95-42010a9c0009", "comment": "Malware payload (OffLoader)", "timestamp": 1786453779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786453779, "uuid": "eea3ca3f-010b-4937-8859-56d959641abf", "comment": "Malware payload (OffLoader)", "value": "6ff6409c1484fa8550a5d2b1e0ebb097", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786453779, "uuid": "50cb496f-3566-4fa9-ab41-eaf078ea97a9", "comment": "Malware payload (OffLoader)", "value": "3d1a911669431b2ed5a895f48d54a966fdf0e80781ef977bf5090298442e71bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786453779, "uuid": "d296b342-b47f-424c-9371-86b21c8bd81a", "comment": "Malware payload (OffLoader)", "value": "55b338234a76902cf5f5b222f5545286fe71d9b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786453779, "uuid": "6dae9090-054f-40d7-b2ee-a1f2843833f5", "comment": "Malware payload (OffLoader)", "value": "21ed588d7a467f46deb48f15074e11df70d5505a41ec050a5554307de4afdf99c2e579d2d3752e85addc5a76a856db81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786453779, "uuid": "2c54369e-ce70-40f6-80ca-2e13df6b2166", "value": "T1A496D054705EB98AF3F0C936A430F794D5EF60717A228876F48CBA7476A7340096E63B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786453779, "uuid": "01a04047-dcfa-4a3c-bb35-e681034a8e01", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786453779, "uuid": "d285f72e-99f1-40a9-9bf4-a5c09bdb3840", "value": "196608:ctbm1n0knp+GMWIP0Vuj/Ohev7z7Skp30f:ctHkrM3PRWhe7z7SQ3o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786453779, "uuid": "6b589b28-4acc-45fa-a088-eec4f263ff15", "value": 9464284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786453779, "uuid": "cb77370c-dc3c-46ff-b5c1-11f989c09853", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786453779, "uuid": "90ab0d2a-fac0-4e9d-bcfe-433b61a3fdeb", "value": "Ehdbdg_2026.02.26_21.06.47_SETUP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e2b2fd6-9569-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786441601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441601, "uuid": "e84dcd46-27c7-4506-8b14-541954845c98", "comment": "Malware payload (Mirai)", "value": "bc35f3d2afebf165e55b5a5d998dcfbf", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441601, "uuid": "ac105a68-0e0b-40d3-8605-d84031393f49", "comment": "Malware payload (Mirai)", "value": "3d5fce70e4310a88efcfaaa7300c1591953926fdc3359001e70e9367fe3dafb6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441601, "uuid": "fdccbad0-44bc-404f-80f2-3dc0ac85fecf", "comment": "Malware payload (Mirai)", "value": "4b8da52fa324ab5b0962b3dc6c826aaa2588b95c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441601, "uuid": "7724def9-6957-494f-bc71-2cfca4898d16", "comment": "Malware payload (Mirai)", "value": "d6caba0d7895ff7091277bed589ac3ea1914a3700e0fafb851e3e923fd7f7c305d78bb772703ddf5a312aa4f13eef160", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441601, "uuid": "d336c4d6-89ec-4e23-9390-5d16a5c99f1b", "value": "T11711BB08C7C25F20A5906C45F0C76017B51783DC36A31AB4BF06EB36782C849B02A9B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441601, "uuid": "604968f2-a1f3-4cf8-bd83-880bcd46de4a", "value": "24:QvQhBh9M0oEhBh9M0oEhBh9M0oF1KK6BaC:QvQhnoEhnoEhnobKK6BaC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786441601, "uuid": "93f3023b-2850-404a-ab60-5ac783860eae", "value": 1099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786441601, "uuid": "dde5ddc2-3702-47b0-a732-cacba757812c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441601, "uuid": "7d0e431a-b676-4ea0-9059-5923d926071e", "value": "t", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d50a61d6-9532-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786418098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786418098, "uuid": "0b9b8da7-d732-4c62-b76a-5bf99ce6a2e6", "comment": "Malware payload (Mirai)", "value": "8ac92cdc6eaf915e259c61ab003a3d7f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786418098, "uuid": "00220722-37f7-4e8e-85f7-d8db04db1baf", "comment": "Malware payload (Mirai)", "value": "3d7c35780cb6d8be890b9a0f6937e905b2b1df229c7f4b6f0c65aab0d74ac992", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786418098, "uuid": "4ecb7845-b2c5-4f86-9eee-994cdf2dfaa4", "comment": "Malware payload (Mirai)", "value": "1e1b716536458dd062ec7ea0da69919f42656fac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786418098, "uuid": "fd12dcb0-2227-49b1-9505-a53b4e1c3d08", "comment": "Malware payload (Mirai)", "value": "4bf62cd353c02e19d44c6c4ca5f59cb11bb4f4bb34b7608b1e5b49fa507ef2543612655924ad32892624c1aea7c0d13e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786418098, "uuid": "cb18c07b-2400-44d1-8cf9-ae0dc5775ae9", "value": "T1AC43F1C55E0CA453F530083BDDBB4FD1D9BB4BA906FA353060185635F2CE986A07E643", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786418098, "uuid": "135ba463-df29-46f9-8977-053d53f2951c", "value": "768:IEBd2jq45ged18OCVJRaPjVYUnSxJ1MWenl19OBkCJ5xxABGeZNY59vI7OZZACd8:feBd18zUjVDSxJOVDUeWLZSCdsf/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786418098, "uuid": "6d3a1d8e-1b47-4a5a-a482-6f23b62f4684", "value": 58528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786418098, "uuid": "badb46c7-10cf-4854-bfa3-817e593575b4", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786418098, "uuid": "a20e64b7-a78e-4145-a2b8-2c87bd5abd92", "value": "putita.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9341e20-9524-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786412145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786412145, "uuid": "ab0146b7-c64c-4371-9ce7-889949999320", "comment": "Malware payload", "value": "03019c4f4944b660aa8355c5f61321d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786412145, "uuid": "b46e72e6-7078-47a0-bc3e-5688a336d3f1", "comment": "Malware payload", "value": "3dd7b8084d0fd21045bd18309630c2eaffce420f7d4c4db56d79935e0935c333", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786412145, "uuid": "ba5701d2-3976-4a48-acc2-3ad31bcbf529", "comment": "Malware payload", "value": "9df0ad3e642fe8d61af0042b3d41b37bde9171fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786412145, "uuid": "0990d8fa-b939-49f0-b8e0-ecf1fa1fc863", "comment": "Malware payload", "value": "2f37bd5d509715830be716544e18a19fde9b44721547cfee252c837c43d451e18e969bc848ce0ac434226b98bbc1e908", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786412145, "uuid": "5339f1cc-bd6a-4f5e-a96d-51f980fc0f8c", "value": "T14B735AC29C218724C2E613B857F94A55E3D11B1236CB3301CAA1F739BD9E1A4B693D9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786412145, "uuid": "7f865f13-2330-4108-9850-905de7365868", "value": "1536:90QZpLJMABayGIcB9tv5/hxgo+G8VJc/gQ6A2xyLoTy7oRQY0rYp:FLdgy5cBDv5/l+GrN6A2xyLoTy4QtY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786412145, "uuid": "4bbe0041-8e27-4435-93dc-97832c3176e8", "value": 79088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786412145, "uuid": "30b8f038-8937-4f7f-b81f-d9ef2098b69f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786412145, "uuid": "cceca7fc-9399-4416-96bb-1f6a42523e53", "value": "main.riscv64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a09db638-9591-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786458812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458812, "uuid": "20926aaa-72ef-409e-bade-628be9602495", "comment": "Malware payload", "value": "d616134a612dc223e83d0d834aad8ff5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458812, "uuid": "3afb7d9e-d5cd-4e5b-aaf9-846633fadd37", "comment": "Malware payload", "value": "3de86fccb5243b51f6560f8d4107649115ff82e646039510e65d72b747eaa325", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458812, "uuid": "1f67afbc-c49e-4af2-9223-d0380ef4e141", "comment": "Malware payload", "value": "5e4054477c01f67b3e5c50b1b2ffa26f4a8147b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458812, "uuid": "0ccb0afb-09a1-4534-950c-e681d9fd5d78", "comment": "Malware payload", "value": "01cd2d3f271fca5b4af0fa735ace147a7c689e8fcb57cf2b13bb949bdcdb3f97ded1a690b0f644caea9fc6f4cad4d566", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458812, "uuid": "207b2721-5010-4723-86ac-f4cbf36fa050", "value": "T17153AE91B70E7F9FD0A22A3FC101165E3F34ADE0AA036633D1927A2396771731E6D846", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458812, "uuid": "16b5a4b5-268c-4d25-bb58-4410c6ab2cac", "value": "1536:d1s4poCLrXgVF+CbLF7jtiZA2XTBWSo+uFRYT8rs:PBptrQVYoLF7wJo+uHYTUs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786458812, "uuid": "db00d699-e9f0-4de0-8d9e-c77a304bcec7", "value": 66208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786458812, "uuid": "dab1f183-1ce3-4202-8164-619f7a7fe83b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458812, "uuid": "18969692-8d8b-46ee-b17b-1bc77cd94d3f", "value": "main.m68k-68xxx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aebf825-95c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786480250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786480250, "uuid": "445473a5-bcc7-4823-9cc1-4da3833a1826", "comment": "Malware payload (Vidar)", "value": "94aa8c4ade2f5db558c7855faed037ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786480250, "uuid": "f16b246d-c680-48bf-ad00-1a28795fa4f6", "comment": "Malware payload (Vidar)", "value": "3e728ad2c89e10217c174377627b535cf942fc44c7a6804f8f621c6861fe4a44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786480250, "uuid": "212be4ea-8977-4d9e-b58c-e3b3a20952ff", "comment": "Malware payload (Vidar)", "value": "58b2e6972e6cd5a878616417511cdb1d4a8c02a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786480250, "uuid": "43ab816d-5863-49e9-a367-fc23377f81dd", "comment": "Malware payload (Vidar)", "value": "e3160b498095c5aaff5e4a7d7f7fb7c3031db941cb33649beb3f2b838ecae60da10eff6c1adf4ba865bad894e6b6a725", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786480250, "uuid": "723d1ae8-3055-4f6b-8ff5-35cc0dc4805e", "value": "T1E0267B03BE9149F9C1A5E73189774252BA74BC4C9B3133E32E60AAB82F763C06D75B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786480250, "uuid": "85173ebd-0555-4716-927f-eeb65f4fa66c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786480250, "uuid": "04c14760-d59c-4377-b84b-25009d9f4b27", "value": "49152:KjXhfL3MVfDAfJaURVZkeZbGWtj7ZYusBHtdV0H22E5kKuUkP7AGyYH:KFN3RtZbQBHtL0HZYCUkP7kYH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786480250, "uuid": "4a424027-f74b-48f9-9473-7b635e31eedd", "value": 4724072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786480250, "uuid": "680aab2e-3545-4137-99ee-1c03a9439993", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786480250, "uuid": "295e742d-ab1a-4d8b-a7ab-d5725ee6438a", "value": "3e728ad2c89e10217c174377627b535cf942fc44c7a6804f8f621c6861fe4a44.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2400c247-9569-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786441423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441423, "uuid": "bb29c2f3-2928-4394-a3ed-2a780b98f4e9", "comment": "Malware payload (Mirai)", "value": "66dc4b523db5481edcce69bc856d2eca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441423, "uuid": "e44542d5-d14f-4824-998f-5fb056a753ad", "comment": "Malware payload (Mirai)", "value": "3ee840bc79a034e38e1f4d42a19fbdc7cf50bea0581bbcdbd92149b6009fbf90", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441423, "uuid": "b0f5de59-12cc-49dc-8212-44e09205c47a", "comment": "Malware payload (Mirai)", "value": "1097f2f04ed77e5103bbcd0e0dbb0652720f5c8c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441423, "uuid": "e6a00c6d-b1e2-4805-a459-e3ea10df16cf", "comment": "Malware payload (Mirai)", "value": "6d184b20d59aed058a84fc8ab583ea4b09a44bf84da7037cea70db5e426ab739f499a1eee41be11f00c5b1692f9e4788", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441423, "uuid": "088bec39-da70-43e6-b110-69f0a2408197", "value": "T1E3245C47B98190FFC08AC1785BEAE436E971B0AD527CB25B23D49F262D4DE711F2DA40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441423, "uuid": "ace71b6b-42f8-4f47-90c0-5a51736da28c", "value": "3072:k/FB4S0H8ZXe12K37QDGXeEv2Rnyo890dVT/9d/fbvq4Cym8iiwbi:k/r4S0H8ZajrmbqojHyJLMwu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786441423, "uuid": "ee958104-8095-4f63-9de4-b381071edf4b", "value": 211624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786441423, "uuid": "49389deb-9a85-472f-99b1-a834d9190c85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441423, "uuid": "fcc71e26-29da-4afe-bc28-a67a7cce7c7c", "value": "debug.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c85e22a2-952d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786415929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786415929, "uuid": "dc3f3678-46e8-4b97-95d2-ff1965ff48ca", "comment": "Malware payload", "value": "21d7000d82890f46ff02426ac940eaba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786415929, "uuid": "7e975eda-2c51-4ff4-8602-5622187da952", "comment": "Malware payload", "value": "3f270ec0d0398cb4c55bf3ed5ca40f9e9bb56babf191d9caeec2dfed6e086c65", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786415929, "uuid": "8a8e97bf-f816-4a16-909b-ae9c119ba1db", "comment": "Malware payload", "value": "4de032013b4bf3240102d83ab6844c41e0c3d42c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786415929, "uuid": "bb7a0018-2bf8-4731-9c3f-1741ed35830a", "comment": "Malware payload", "value": "81605ab8551d301c84efd872681a2d85bc440cee7298054c78c0d6eeb0ec03cc48b6116426bba202fb1c1e66055121d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786415929, "uuid": "4d2888a9-b37e-4c60-821e-f538584fef0a", "value": "T1AC635316AB619D77C81FDD7301F8860120CDB49B52A93B2BB1B0CA6CF79B98B05D3D94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786415929, "uuid": "404a4222-a729-40d8-b04e-411e6a9dbd3d", "value": "1536:Rcybpc6RlRZiM4TL5tzRUp3dxPohLPgfdeS:bXpn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786415929, "uuid": "df5cd826-6563-4fec-af86-b0788bd25ddd", "value": 68456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786415929, "uuid": "0734a01f-67d7-4a60-9751-7c4eab172d55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786415929, "uuid": "c50918c8-9274-4150-8ff7-cece7444f576", "value": "main.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf866778-956a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786442140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442140, "uuid": "e8603cbf-8a39-4e15-b84d-1dbf5ca9d6bb", "comment": "Malware payload (Mirai)", "value": "857fbce71465d6997df2a8ab630a4ee4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442140, "uuid": "5082f3b6-8eb3-4378-a3ab-f27a5b15b521", "comment": "Malware payload (Mirai)", "value": "3f5acbdfe7861fb5b193691c38de3a023c9ee7473fb0debd69e134a9a45fe421", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442140, "uuid": "ee1d6c41-e424-4cd9-9ada-06501ca15704", "comment": "Malware payload (Mirai)", "value": "320f5c85abd41fd21603d773aa0b79ca9fd9068a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442140, "uuid": "392b1358-b482-47f9-a66d-f24f9a95ee38", "comment": "Malware payload (Mirai)", "value": "b4eee62181c25edbed9b865c9cf5f8e42c202c3aa9cd9960745fdc0c9031cf070218a450bf423db1fd4c22da124c4791", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786442140, "uuid": "62bd13d8-b657-4caa-bf10-d79ad5f07d83", "value": "T1F4443B86EA818F13C0D617B9B6AF424533339764D3EB73069A14AFB43B8775E4F26601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786442140, "uuid": "dca16cc8-31d6-45db-b810-47ef2896ea39", "value": "6144:JYgH62T4QadnFD19IoEa+KAg+uF7b4ZmSu+WPja/zn3M/RULVGmn02v0PbUyM:+gH620QWPIoEa+c+uF7bBSuVjyn8/qGm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786442140, "uuid": "85b34825-5b24-4291-917c-ba826d956e4b", "value": 270523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786442140, "uuid": "2bab2c25-8e7a-4bb4-890b-9edf15d2ad87", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786442140, "uuid": "e69807ef-e672-455e-bb2f-e0994f0ee12c", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f039bec-9573-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786445897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445897, "uuid": "cd19b3d3-dca9-4bab-b078-e068047c8904", "comment": "Malware payload (Mirai)", "value": "ae8bcbe24c55c82b6fe3015dc52a1617", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445897, "uuid": "fe777bac-6660-46a5-beae-7e5c3709bc00", "comment": "Malware payload (Mirai)", "value": "3f6d529d60f4537dc1a949e5875903715f523cd274abce7b4b5359d13312a227", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445897, "uuid": "a3313bb6-4b91-452c-8bc5-c7afcdf6e9da", "comment": "Malware payload (Mirai)", "value": "ed43a0a5b8e9cb047b4e15230f5f2da74da1c726", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445897, "uuid": "6f36b9f4-74a8-4d56-bc27-7515dacfbe7f", "comment": "Malware payload (Mirai)", "value": "5e23de8adb2fb257f9ff8bb3452acb497a724684c48bcb5d8791ca5ec43f3cfdc3a21b3d87997dcc05ce3f1311399004", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445897, "uuid": "9f2c8576-0fb3-4661-a840-7a6e859eedc1", "value": "T124044B01771C0943D2A72EF03A3F27D193EFEA9124F4A645790FAB899275E32514ADCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445897, "uuid": "4ade839c-1e5e-470f-a5df-2f0557b5d074", "value": "3072:40Z2a/8THzBr5axERwlcQx/8bWXQ2x3Bjv/P:40OTHzBrIxERwlnx/8iXQ2Vtv/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786445897, "uuid": "113c1d68-15d0-48f6-a42c-20887b27b9ff", "value": 176192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786445897, "uuid": "b2219de2-2917-489d-b766-633114d5f925", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445897, "uuid": "e0e49dee-3d26-41e7-ac12-7316fc49ff70", "value": "sdfjgnjsdf.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cbd0658-9569-11f1-bd95-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1786441599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441599, "uuid": "da04301c-a7f3-4edc-b8a0-b53075a7d5b5", "comment": "Malware payload (Gafgyt)", "value": "423e8749313efb5142b018ebc091cbd7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441599, "uuid": "e69a7cd3-2279-426d-8322-fa15ba2dae72", "comment": "Malware payload (Gafgyt)", "value": "3f70a4f3d36b9521066f80eb7df0b4068ee29db8291879e2badeb1f99049740d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441599, "uuid": "a6d1857b-5884-4f90-a8a2-028446b9df17", "comment": "Malware payload (Gafgyt)", "value": "492bf12d841f6a75d703829efbdc83a91174bd3d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441599, "uuid": "3f1dd8b7-91c1-4930-a354-265df267eeab", "comment": "Malware payload (Gafgyt)", "value": "516c7d13da5b8876bf23329d03a46403152d9dc84e6a1711b2621962046552b656b64876809226a5b6f3c67712aa8d10", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441599, "uuid": "a28f09d6-cd00-4272-a0b3-cc925ae47ec3", "value": "T1BC71B2CB21A20AF36DA0ED3332B58484F8D4A48B94C69F0A6DED3CD548EED5CB441783", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441599, "uuid": "9c1ace62-79fe-496a-b0cb-f280f4c170d1", "value": "96:1Od8RpttQdMogPb9puTuE2YwbrJ5vYwb7aIkIENq89QMrUU4EQrUkJD/:7TQdymxsf9/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786441599, "uuid": "53d932f6-5db4-498a-af0d-d2fa88f3855b", "value": 3762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786441599, "uuid": "f96f56ed-da4f-4a5d-93e5-a7124c5742b2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441599, "uuid": "be1cba65-63e9-490f-97c6-c629de0d2943", "value": "Sakura.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ac939d4-95bb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786476653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476653, "uuid": "85103687-c979-4cda-8092-ab6f8d244370", "comment": "Malware payload", "value": "fc3db9442a7f9dc5750a89be9e3e262a", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "unattributed", "colour": "#1869C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476653, "uuid": "2a3be507-e8d7-43d2-aab0-8f0aec865060", "comment": "Malware payload", "value": "3fb8fc157204246965601e5063343320eb6c5796cb20409f29b40ea58b90b6f4", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "unattributed", "colour": "#1869C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476653, "uuid": "259eb291-6007-4e79-8194-e61640f1dc4f", "comment": "Malware payload", "value": "47486d0a2e692d912e3c0d725c6d20bd198eb927", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "unattributed", "colour": "#1869C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476653, "uuid": "39acbf8c-0dbf-4969-bb69-9fcdc434d376", "comment": "Malware payload", "value": "d1be512938c11fd1f5d26fd3697d63164aa5da713ca4720824e52e96eb61be16ee1a0dc9ca8e98d41635abc5191de75d", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "unattributed", "colour": "#1869C5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476653, "uuid": "2cef6ce3-1ff6-4efd-82ec-61963d7fd13e", "value": "T18E56338AA58380A1D86636B08503D4FF7A3F34C78F45CED7D8D55D8CACA2ED9353258A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476653, "uuid": "58d6ca50-01e1-4ab3-9d87-a4e5e60c36bb", "value": "d4b45184672816eb7e23441f846a3e1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476653, "uuid": "fc80f4d5-8316-4480-983e-b15890e481be", "value": "98304:zBj1A8gxIe6xjonuXuJSOYjcKJnTTLj/s1ZgyU89LEuWUYbnF0:2xIey8xJOjNJnTTE1/U2ExnF0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786476653, "uuid": "230c7940-13f9-4f84-9dc8-932b55e44f8b", "value": 6145024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786476653, "uuid": "cca9e78f-10ca-473d-a68b-1610b256125b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476653, "uuid": "c351dec1-35af-4701-a939-5e608a7edb9d", "value": "3fb8fc157204246965601e5063343320eb6c5796cb20409f29b40ea58b90b6f4.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cef8e51-9551-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1786431184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786431184, "uuid": "c1c7bd1e-5683-4e14-ba27-a4a5828cdd08", "comment": "Malware payload (CoinMiner)", "value": "de316cd369c622e7e5f04423b160118d", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786431184, "uuid": "157aa37d-9952-44f4-bf02-e560cd4ebfb5", "comment": "Malware payload (CoinMiner)", "value": "3fd1b43c2c06c569cebd4865e4c29aac2088df774aaa00fbd96e34503495eab6", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786431184, "uuid": "3b45aa54-f685-49ee-bc57-df60c482e0cd", "comment": "Malware payload (CoinMiner)", "value": "d4772e03fcf11307711a72c707e32d649b3b731c", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786431184, "uuid": "79e64203-2fb8-4427-816e-436cb4a15871", "comment": "Malware payload (CoinMiner)", "value": "1b945b85f62e8d3d82c920236681a6c2c10e4aab814bd17ce4236ad32e072b4aaad0c009fa5f65757a1c93aa6826a759", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786431184, "uuid": "1f85c7db-1ef0-4f43-b43f-7a83d57132fa", "value": "T150F5336D9D7411BCCAB0847AD01D8F2B572B6600C7A26FD3B2DA3A25793BEC37532914", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786431184, "uuid": "ad3c8f46-95ad-4985-a14d-78aa8ab98952", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786431184, "uuid": "8f3993bc-ae7f-4696-9e8e-23ed59b41910", "value": "98304:8TeMb8p9awYg1WxHa6uJK3Tl6cBmLi9mF:Ar4swzUxHa6uJC6cYLi6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786431184, "uuid": "dc32657f-9566-4edf-b6f0-b472eb1c990b", "value": 3447784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786431184, "uuid": "da3b589a-b82e-4ef7-9797-85d2ae3ff593", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786431184, "uuid": "04b54625-605b-446a-9d3d-ce7601f4df74", "value": "de316cd369c622e7e5f04423b160118d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99fe53d4-9529-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786414133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786414133, "uuid": "4bbfc99a-f006-4aa7-b19d-59bef9bf4ebc", "comment": "Malware payload", "value": "6c5ee420f412c0b1661cfe81a5be6f2c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786414133, "uuid": "25fe02c7-9161-4f39-8fb3-9835d2e4eb7d", "comment": "Malware payload", "value": "40506dd6fa56f5b5846f98e5d5d2f67ce1705875968d311149b5598182997855", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786414133, "uuid": "e4cc0b73-5d63-4e44-b21a-f8caeff5c086", "comment": "Malware payload", "value": "d39b972a059b4bfc8ca6cc88daa7b60f55726146", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786414133, "uuid": "da03927c-a15f-4928-8acd-52e67261bf82", "comment": "Malware payload", "value": "819b457d0c7e4d304ce38904ca608346465ef162faf18b9b8db38d777aef9bf3051a210c9cc103dc76f8e404bea05a22", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786414133, "uuid": "a29bbeb9-ce52-4754-baf4-6c89df509746", "value": "T1EA539D6AF0D6ACF6CC5049B6E872D0300B417DB023EA1D85F85DF2A45B3BA967E4D760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786414133, "uuid": "b04ebb93-582e-42df-8361-62fd9c63f517", "value": "1536:uwcfdB/JUtmPe6cP0qcea+Mqs5NQOFw2qaP/0r:wdBKd6pqcearpNnFw2xP0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786414133, "uuid": "ec687b08-43f4-42e0-aa84-6a6adda16ff7", "value": 66340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786414133, "uuid": "204275df-ccd7-4dd8-80c9-09bc5ac9498c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786414133, "uuid": "44673fef-6174-483b-b984-a76013c903b5", "value": "main.sh4musl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73dbb3a1-9596-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786460884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786460884, "uuid": "ba899d28-8726-442b-a88b-a18af436b44e", "comment": "Malware payload (Mirai)", "value": "9d95c66497391351d304786645ebee67", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786460884, "uuid": "c2934b8c-d30d-4f6f-960b-32bb83aaffa3", "comment": "Malware payload (Mirai)", "value": "407167ab7f785761b7a80175c787947a2e4faeb2b673354c9f27c2dc55f96ec2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786460884, "uuid": "d8cabdf0-54f4-48ad-960a-dd74a7d537a5", "comment": "Malware payload (Mirai)", "value": "c73c04cf38d36be37f0a5431b1170c30509269e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786460884, "uuid": "c7fdd832-09c1-47c7-9198-98da295f0508", "comment": "Malware payload (Mirai)", "value": "a988847899fb38b3dc63d56c9ea1d3f404bc893c60589ebed64a5b1c9e59f9f10a77ca8b46b964958ee5aed6326346a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786460884, "uuid": "1ad6998b-2363-4637-9985-8c8d0a6e9475", "value": "T1F573123C96DFB052DB89EC7662590B76262121E9712F538A831E8C4CBF78C4F5D418F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786460884, "uuid": "0dbb2020-a03f-4b6b-8865-6b78f6349216", "value": "1536:dOWd9J587xCrzWK7qBN4jDr84yRcMhWbo6fYUc6hG:r9J5yxC3nCwWRmY36A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786460884, "uuid": "fc6fd448-6f0f-42ac-a784-cb9f8f9fe5f5", "value": 74556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786460884, "uuid": "6993daca-2cba-418f-837e-3bac14c20187", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786460884, "uuid": "00eb06b9-9b78-4331-bbe0-570460acc138", "value": "sdfjgnjsdf.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd6ad2cc-9569-11f1-bd95-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1786441788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441788, "uuid": "016fc6c1-ac48-4dd5-a6ad-eae954229df9", "comment": "Malware payload (Gafgyt)", "value": "499dbac69938569ded0518282643bae2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441788, "uuid": "46fd92cf-5294-4b33-93b1-ba48a3b87879", "comment": "Malware payload (Gafgyt)", "value": "408026ea525490fd64312ace9e65d433ce6f0f43f3ae833834261aade507c2d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441788, "uuid": "32b7e88a-6f1f-4dac-9a27-60ac9f3f8d87", "comment": "Malware payload (Gafgyt)", "value": "27b251c0ae97dee6c2bc38add7d0a1d20c34d2e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441788, "uuid": "71d8db07-9557-4555-93b0-8e9d9e360b57", "comment": "Malware payload (Gafgyt)", "value": "948ff810541961aea6b40aa79bd873d334a7fa8d06e0f5ecf8546c0148174f992710e51201cedfb387cd4cb0abd388a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441788, "uuid": "cbab7055-3586-4dd6-8a46-b1e4351a1886", "value": "T139E3843E7E22BFBEE26882310BF35F70979561D227919346E26CE6181E7128D1C5F760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441788, "uuid": "d7ad5e2b-1f31-484c-a9cc-c7c108d2bdb8", "value": "1536:LqAo2mV7PguPkn02rKCpSuSdS3So82rKCcS1LFfqFp3nem1nYose/d4BJJFOAmDP:lKGdrZWn71vOBJ/mDOVcG1DJ01so", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786441788, "uuid": "d9d4063f-8e5e-407e-bcb8-ebe5f884d914", "value": 151009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786441788, "uuid": "bf7cb513-42d4-4271-a269-9725ea9e2884", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441788, "uuid": "df631c4f-896e-44c4-9b40-75f294ee93e5", "value": "m-i.p-s.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9683a1a3-9594-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786460083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786460083, "uuid": "9849d5d0-2861-4522-9983-0f86cd7ee006", "comment": "Malware payload (Mirai)", "value": "d55762340087dcbe4afa5a948c55ad4e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786460083, "uuid": "c9b4000c-0a59-4d7d-bddb-741672b2237a", "comment": "Malware payload (Mirai)", "value": "40aa1d681241544693a96457a4b79d4dd2d67916f3500ca23d2e971e11cd47f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786460083, "uuid": "1e93e325-3b39-47cb-9ab0-c295e67b1082", "comment": "Malware payload (Mirai)", "value": "f8848000016d528990b9dcae4e8a76a1d485ccf7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786460083, "uuid": "acaaa5d8-88ca-4662-a22b-02c72f9c1e01", "comment": "Malware payload (Mirai)", "value": "0d0497ebc49651c9a1e8c7590d4e27279f4bebf3fa31ff0788c4dd16c05e7d5c89d51c8943cf99be2f7125d87cd3f853", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786460083, "uuid": "05044937-4d4b-41b9-b409-baa64ca6b726", "value": "T1F2B35B83E707D1F4CA5244B04067F73A9E31EA225235DA5FEB90FEF3A962603941A35C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786460083, "uuid": "128e3cfb-b923-4c69-b764-6107c8ee29e5", "value": "1536:9g2LAQXoAJC6C3IxBNZ6KSI/o6YroYDGAlVaY4CUGzGqUb31H4zGC8ngr:eQ4AJC6CyBNZ3SI/oDrFDTHaYs/54X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786460083, "uuid": "abab5258-2ca1-4460-8fac-8d0442ba0940", "value": 112364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786460083, "uuid": "526ca23f-9628-4a01-8685-219be235d746", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786460083, "uuid": "65ac0d65-a02f-4dce-9ff4-1dc8ebe27c31", "value": "sdfjgnjsdf.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b0cb15c-9524-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786411960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786411960, "uuid": "1ffd1a04-6ebc-49e3-bce1-e383ccb58da4", "comment": "Malware payload", "value": "6484249e4bbaa67cec268d7a18eb7df7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786411960, "uuid": "6d848301-491d-4e89-a4a4-8bce9ddefa9b", "comment": "Malware payload", "value": "40ee84ea58804b34c5f9b741d988ce497f029ba143b202887581bbffe1df3851", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786411960, "uuid": "2ac82fa3-4320-4ca0-92f3-ca10a1189f1e", "comment": "Malware payload", "value": "b151330f2793dbae74cec9fd12695eb7b8714992", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786411960, "uuid": "3c8b671b-a94d-461d-96fe-37c7cce56932", "comment": "Malware payload", "value": "c07f49636dd36e08be4e39b5f4ae14b5d12b0ebeb654b84930655b8bd546d3965bac4033689678d342a06d229935352e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786411960, "uuid": "7c3dbc7d-dcfc-44a6-a091-6e620c060b21", "value": "T148A35B42DD2B4761E2E207B00BF95B4293616F2629D37345C49CFA38F95D1F862C2EE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786411960, "uuid": "e3ddab07-a1c8-4211-9420-7948c16add24", "value": "3072:JAG/AClxtC5s0em6SKFJR9YwxZFQMszmzA:Jt4Ym5sNTJR9YwxZqMsz6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786411960, "uuid": "1bb7ffb1-f34e-4663-8215-c692a078eda2", "value": 99200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786411960, "uuid": "f0f2676a-ed99-4405-b05e-8724fcee08fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786411960, "uuid": "4822370f-ad81-4a14-8b0b-39b8a1658010", "value": "main.riscv32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe918b54-954a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786428475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786428475, "uuid": "c462bc28-dee2-41a8-974f-3fbabbef1317", "comment": "Malware payload (Mirai)", "value": "504c5f6de9ed7549e52122d5ca4be112", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786428475, "uuid": "3a8f86cf-4abf-4246-8e1c-fe69dcbbc658", "comment": "Malware payload (Mirai)", "value": "40f669c30030d844311a2a3550c11752ad4ab022e9187db0615dd172f7c0f0b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786428475, "uuid": "d49ef684-d2aa-4869-9cf3-9a7523a325bb", "comment": "Malware payload (Mirai)", "value": "8890f7855835ad10a2011d7b41c302ef450a7b22", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786428475, "uuid": "5cac56be-f1d2-4ad6-996f-d8208e3cf5dd", "comment": "Malware payload (Mirai)", "value": "bfa1b7aeda0a07189ca053ce52d59f788b0857fbb9081fb48dc332d89063fbb2fb144cf8c8a194a7374e7d2e59f8b306", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786428475, "uuid": "0aa87ccd-cc4c-445a-b892-3e1a115a1580", "value": "T106734A6AB9519F0BC2D21677BF1E8349332723B8D3DB7202DE166F15338B51A0E2A195", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786428475, "uuid": "ab3f3f79-1a06-4f28-9578-30626aeb10a1", "value": "1536:p5XDdcq6PVRCfaG3HsTlIPmeZA2ZrZv7vsVZcMTFgExFmsX9z:plDiq6PCaQHsTSPHZA2Vp7EPzTFgExF1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786428475, "uuid": "f3ccec27-0998-446a-8714-ddaeefdcd45b", "value": 75752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786428475, "uuid": "58aef408-4ef1-4c4e-9340-2dccb33a38d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786428475, "uuid": "cfbfc8c0-d895-4269-9c35-daff0823eb48", "value": "1Gk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f08da684-95cc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786484286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786484286, "uuid": "7f8bf5ca-da11-418a-b738-b174a6a9dc07", "comment": "Malware payload", "value": "1e8d75b10d9d64df76d04e72309334b0", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786484286, "uuid": "db7a1995-c2bf-4ac4-b1e7-f7ebb6b62c56", "comment": "Malware payload", "value": "410a5cbaabc1cdee003ac2fd1d6c1ca8b58c9eb75cd7c671dfa163653b5ae712", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786484286, "uuid": "d18d2e8f-54ea-495d-810d-4a5d71480bb4", "comment": "Malware payload", "value": "a2408d167d1714fd167361ec0d4e6b7815fe4c8f", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786484286, "uuid": "1c49592d-8d86-4e9f-8258-6fc80a1e5bb4", "comment": "Malware payload", "value": "793061c92fd93344a9e977b8a38502dce5a6e54cfc519eae70c6decf4301bc169e9ffdea4eaba5e69bb93011cb7bc744", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786484286, "uuid": "ccd61488-4604-4ebd-a9f2-cd417e3a5499", "value": "T169D6AD07E7155A32D2BE933448EE434967325E9AB78387431688B47C7CB32D19B9D2CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786484286, "uuid": "b5eed7f1-a736-40f6-b0f4-eb4bdfcc2721", "value": "196608:BY/e914fz+RFm9tqeBd++NIGvKvNEa/ONSsX7qO:BT14fg19K3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786484286, "uuid": "f038345c-79a6-40c5-b2b5-97a6367ade1d", "value": 13783232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786484286, "uuid": "0beb5139-c578-4be7-a980-2b5a17ef566c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786484286, "uuid": "b270ddf9-383b-4519-80d4-6870378507a4", "value": "410a5cbaabc1cdee003ac2fd1d6c1ca8b58c9eb75cd7c671dfa163653b5ae712.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40424a25-9533-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786418277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786418277, "uuid": "f458b17d-bb5b-4f67-a9fa-b0d4964f6991", "comment": "Malware payload (Mirai)", "value": "197cebb32764b68642b953f0441bb577", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786418277, "uuid": "91b48e73-5f71-4b7c-97c1-04d93e01c216", "comment": "Malware payload (Mirai)", "value": "41126c3bd0439fa7be2f6fe980c10aa47670ada29bac5550d2b661e8d79ef87d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786418277, "uuid": "0ceaee68-96e2-4c2d-98d0-28bedd0f62f5", "comment": "Malware payload (Mirai)", "value": "b0caea9cc24945f1dbc8ca03ec9ace475d4a9bb8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786418277, "uuid": "66ef4093-e124-460c-a585-60cc9e4f8aa3", "comment": "Malware payload (Mirai)", "value": "342bf7e63da3db4a1bac702b94510a3da230d1d3fecf9decb84507290fc4db05aa36d4aea4e87fb02d67ec49a42c8e71", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786418277, "uuid": "f374b3f9-ce55-48a0-b779-26d9d9baf16c", "value": "T1BA63F122E5071C6CD2AF6DF85A17DBE43775E68D213055C0178EAF982977712BC84EC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786418277, "uuid": "72e7103d-1680-4ec1-86c8-5846339b8632", "value": "1536:kswrVMHVEh09lUcpKcsaU9jEX8isnGFdbKkpHqMQnub4u+qgw0ri:WZUb9lU7Z08iCUoUQnub4u+qgwV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786418277, "uuid": "e699195e-6ca8-4255-8dea-38818b754597", "value": 67776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786418277, "uuid": "8fcf3399-49b9-473e-88a8-423e0ff6f222", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786418277, "uuid": "e860b7de-f8b7-46cc-acca-62cf907694ee", "value": "putita.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19cb8dfb-9532-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786417783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786417783, "uuid": "ab1fcd0e-55ec-47b3-b75b-70f1cc46bfa8", "comment": "Malware payload (Vidar)", "value": "59edd45b66479007181f4a758f18ae2b", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786417783, "uuid": "311efe58-8c31-4151-a50a-ba457b6fe151", "comment": "Malware payload (Vidar)", "value": "41545be2703234f8e11461b84547fcaf89400520dd77ab15648d931f7e0941b8", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786417783, "uuid": "8013f486-e1d4-47a9-88f9-c1b99fbdaf8b", "comment": "Malware payload (Vidar)", "value": "d636d2e5b18060ff25eee8a0d807ab2a507185c2", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786417783, "uuid": "f7323106-c44f-4b8e-a6ca-61f19f75d981", "comment": "Malware payload (Vidar)", "value": "caf7205ad94976f1b4308065c339f548f8a451c6a7ab31c256d7d543bb220238fccc2453b89659b9b1eb18d5889a47c1", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786417783, "uuid": "f9de112d-13fe-47fa-9666-0e22bb2c4a89", "value": "T15308339A3E22E03FF453D473D11866E9725BE088E7338B96222F90DDF8E26517B44167", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786417783, "uuid": "db2f4467-14d6-48ca-bb70-bf9e83cd8b7f", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786417783, "uuid": "b0d32050-5886-45fb-a249-1524cb1241ba", "value": "1572864:4Q2um44HifEisaBzg1nNHG3cv4JW4/KMYAMvJmiftzjPzcsZM2AWUQriXy9:4QTm4vcIe9NYJo+sUifljLcs22/j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786417783, "uuid": "e8de245f-2e07-4943-a168-73815ce19f0d", "value": 83014063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786417783, "uuid": "dfcd95ce-c5b5-4e43-946a-f3aa570b64a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786417783, "uuid": "cf99bcc8-b9c4-4c8e-852a-9b4867d983e5", "value": "Void Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ba80a1f-956b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786442456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442456, "uuid": "2eb9fe09-b8ab-4083-9c49-3aba37e16ab9", "comment": "Malware payload (Formbook)", "value": "22df13f0391f9708512f74a7dbb83b74", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442456, "uuid": "f0c7d502-6ab4-40dc-bc66-98fe6ea977fe", "comment": "Malware payload (Formbook)", "value": "4163def24e57962ff7982b0d948a0f586ce1ad463373ce2a266af114bb8e4158", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442456, "uuid": "8ba9bd3c-2602-4cb6-837d-a69cf70602b7", "comment": "Malware payload (Formbook)", "value": "024cc43cc9851a2b6671b354566d8eccabd3270d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442456, "uuid": "eb5bc413-bf01-4711-b5ab-3524b46a803a", "comment": "Malware payload (Formbook)", "value": "b0e736d36f6da4870f740c8a7739dd3d3a1c6e06de6f0ac3a1b8b67f39e08bedbf55a3dbaff642dc3555cc3b820c606c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786442456, "uuid": "5c360e33-903e-43e7-8c12-390f739fcd3d", "value": "T168D3444A9ACB38445337673FA72AACD4EB3607A700500907F47CA696AFF1D16D9E0CB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786442456, "uuid": "de625673-b803-4ab1-a850-383e3512cd1e", "value": "1536:4nMGBuqUktUQ78odi5c0i5lp09C5+F1KVEgtQtjZ2zgGdNnAch9XXfL:kMGBuUU+BqH1KVEgtAZ2fA+9T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786442456, "uuid": "61b56bc0-412b-4d79-966d-01369a95d49f", "value": 134614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786442456, "uuid": "a4681940-0554-4e9d-9fd9-21bfcc85a360", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786442456, "uuid": "0464e042-1911-40ed-b651-4439f146b848", "value": "MokkiHUb Company Profile.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a440ff0a-9565-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786439920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786439920, "uuid": "9c5718ab-6f2d-4273-b281-25d9cad49972", "comment": "Malware payload (AgentTesla)", "value": "c761146981540c657a8fd4b761ab98b1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786439920, "uuid": "430f9bdf-9f9f-48a8-935f-082c0c5de5ad", "comment": "Malware payload (AgentTesla)", "value": "4180269c675c26e85d20a22f06587a5a45e6f4af5ee4a60fb73dc51317ce50e7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786439920, "uuid": "55dfae32-92b8-4551-afa4-01e7701a79b8", "comment": "Malware payload (AgentTesla)", "value": "b97b882b6a04a61fd479cb745bc2c10c6c6f63a9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786439920, "uuid": "86895f44-ff0c-4ed3-a189-b44d8e0052fc", "comment": "Malware payload (AgentTesla)", "value": "9dec5abf675ddfde71c665586282ff43011c12c72692e7a61b0b3dbb8b218c7fd8a27a540e7fc116bb99b87170e80f0b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786439920, "uuid": "532b8e54-5c8e-4797-b757-8ba9d4b59a27", "value": "T164340E037E88EB15E1A93D3782EF2C2413B2B4C71633C60B6F49AF6518516466D7EB2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786439920, "uuid": "5e3fc247-04ff-4b87-9f3d-8de325819cd7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786439920, "uuid": "6fea2eea-2ef3-4937-9344-d633f1eed87e", "value": "3072:7OElR1ZlnlE4/fEb7tVudhBEe5TyCS/qu:7OElR1Zlnllcb7twSVCE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786439920, "uuid": "b869c42a-0c5b-4897-84f4-c6beaa256aa9", "value": 240128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786439920, "uuid": "8eccca5b-85e9-41e9-813e-948fbd4d1dbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786439920, "uuid": "73835099-3e43-4527-b49f-9f9c7256ad55", "value": "4180269c675c26e85d20a22f06587a5a45e6f4af5ee4a60fb73dc51317ce50e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85f84874-95cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786484107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786484107, "uuid": "0857536f-241e-47b8-a701-83fc58842de6", "comment": "Malware payload (AsyncRAT)", "value": "29d0ca716e7ba7bfdb279053351225d6", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786484107, "uuid": "7a984841-bd5d-402f-9e74-320f32cf0c2e", "comment": "Malware payload (AsyncRAT)", "value": "418a07ebd7c417bb91e8ca0cbd5cc4ca89697104ce0e5480d9ed09b100463e5e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786484107, "uuid": "3fed276f-b72d-4bd6-8122-dfedd4b470cd", "comment": "Malware payload (AsyncRAT)", "value": "3e4e8ea47d947ab79c5546e83cb1e90bdf98c3f2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786484107, "uuid": "94ad3ee2-8575-4754-a4dc-93ccee458ab9", "comment": "Malware payload (AsyncRAT)", "value": "61399f7f25c756c5d05f984f2fb939c4ec7f6464d77a4f9ee69ad44462e2271e813f60f63ed9d178bc86ba74231bf2cd", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786484107, "uuid": "5cbe8212-7b22-4568-ad2a-44ed511cb3ca", "value": "T189C23D0873E8C572D1FE46BAC83386009775D55B9D13D75A6FC890AE2E23BCD8A14BE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786484107, "uuid": "3519a67d-f82f-4d7b-b66a-f80a3e47149c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786484107, "uuid": "a085462b-bb2f-4817-90cc-597f186e9492", "value": "384:7XRoykXRrWCKOsVa/KFHbp0yH9qbuUscCbQxnCJfJBndnjJmKRXT+:7XR4Vg1VDHt0wIb1BBiBnPRXT+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786484107, "uuid": "5ebabe4a-0757-4aa4-a413-8d76dc0b30a5", "value": 28160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786484107, "uuid": "7f8f63e5-0958-40f3-b959-888ac1ef3707", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786484107, "uuid": "b5c11bc0-c8e0-47a6-b64a-76261da6ea6e", "value": "AU88APP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3777eda7-9534-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786418692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786418692, "uuid": "a955dba9-5cb0-4a7e-b70e-46b11d660e81", "comment": "Malware payload (Mirai)", "value": "a1d53f04d42f50f2d5bd98b51c480c01", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786418692, "uuid": "13d165b1-129a-4b44-8fe5-61c3f85a5a7a", "comment": "Malware payload (Mirai)", "value": "41f9b163ecdf1f2fa932eae6dd00d5cbfa306d17fe58d17b45321d346716af1d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786418692, "uuid": "04b53b09-2b1a-4501-8d45-7980f09f2f1b", "comment": "Malware payload (Mirai)", "value": "6f1b4c745b1008cab1675a791cbd9f784f5bcc7e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786418692, "uuid": "581160ac-51c3-4cb9-ac58-7be4219833ed", "comment": "Malware payload (Mirai)", "value": "36faf110eb3282bd254086a375fab160fb7c5940edf7f6a5a42908ebcd2b7f86287d432e5a3453e953ca2f5c0eb06307", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786418692, "uuid": "f00814d4-7935-4087-b4cc-39a3a4aad14a", "value": "T1E204394F7710DF61C32DCA3046B38B565AE526522AD28889F35CDE09BE74349682FFE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786418692, "uuid": "0c9f435d-5a21-40c4-942a-f52dc9ab8228", "value": "3072:Qg4TJkDyGvrGhSyxnXE9YdY1qqZu1DjjDv:94yDy0Gh5SKdczZsjT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786418692, "uuid": "7e920528-ad62-42e3-938a-116fe1ee648c", "value": 185348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786418692, "uuid": "fd176038-77c9-46ec-98e3-6277f0654cb4", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786418692, "uuid": "b11c7871-b534-412c-9e65-39aea7bb0319", "value": "putita.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4443dbd5-9595-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786460375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786460375, "uuid": "d677745d-7554-472c-a144-08af82daf549", "comment": "Malware payload (Mirai)", "value": "acb7bfcedc3aede155fa07caaac51514", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786460375, "uuid": "db2d78db-e69a-4807-a3a4-9d1be526b34d", "comment": "Malware payload (Mirai)", "value": "4205ae580b524df6d2826eb2308b539236fb90ad7bc121f2f1d71b320239b3d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786460375, "uuid": "a99a7176-91ff-450d-ace2-df79259df445", "comment": "Malware payload (Mirai)", "value": "a72babacbb9dcaa8d48d55f791fb450818e91a07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786460375, "uuid": "c101986c-c85e-4b45-b19a-78fd9c46b493", "comment": "Malware payload (Mirai)", "value": "af471c20dfa6d3e7c4980e0670ff86fbfb54f7353185302389272fc48d819a0051085f1814de8745bb2585c7561b704d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786460375, "uuid": "e04af449-4f1b-4138-99e3-fbf99fffd956", "value": "T1DE042956F8819B06D5D125BAFE1D528E33231B38D2EE72029D249B70778FDAB0E3B505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786460375, "uuid": "8aaa03e5-ff91-483e-8974-d2bde4229626", "value": "3072:DQeM3sgDfF6+gMBsLiQXhUWXganFfF0LBbrNRzBcLv:0nFpNMvXgan9F0dzBCv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786460375, "uuid": "05ef3303-842f-48ea-9afd-e29bc7b9fa88", "value": 183696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786460375, "uuid": "e17e2085-c116-4415-8ae7-d5b499a4f720", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786460375, "uuid": "bed75cfa-1112-485e-ae45-1b4b753c37d7", "value": "sdfjgnjsdf.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d1fd1f7-958e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786457330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457330, "uuid": "2a3b2d74-313f-4008-98bf-8104d1ef7465", "comment": "Malware payload", "value": "b692b9a084d8a0e839d49addd911ea4b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457330, "uuid": "157733b3-b346-468d-804e-d65052381361", "comment": "Malware payload", "value": "436d2e44c26c8975980fb650418347c72757562f7828da9a7b80ab9aa59afb0a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457330, "uuid": "357f7c0c-8c8f-4468-b835-ae0c73b63136", "comment": "Malware payload", "value": "3046cdd8ccf2a360fc24b08e4d481c7d55798a89", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457330, "uuid": "1179c7e9-06e9-4863-b24e-f0d6d7ff3421", "comment": "Malware payload", "value": "d8b82bd0183391456095450400437c552492bb2ccd5013ef0d6e6429a4fa355929e7c873c620e248efc77ec552ba177e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457330, "uuid": "3950d2c7-72e6-4a99-8b62-2ee8ec040f6a", "value": "T121E012EB80918635C05CEA952C67DF8CB881D266D3D0C929C8C800EDCC4CD346A13748", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457330, "uuid": "5d5624ca-9cb2-432c-95dc-5050add6f821", "value": "6:4ib+tiuscMFBHIVCC1zhXQHF1qFgBFKDMFBHIVCUbXQHF1qFgBFKDMFBHIVCeWXZ:4ib+5sDBHIVJhAHXqaB5BHIVlsHXqaBz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786457330, "uuid": "04f0e223-97d8-40e7-9fcb-3ba9139d0362", "value": 304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786457330, "uuid": "eebb4334-2a1f-419e-a145-cfa757216199", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457330, "uuid": "9a7361e7-b13b-4169-9cef-e31cdce481f1", "value": "ass", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53808f44-9562-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786438496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438496, "uuid": "fdf91951-97e6-4c9a-8708-3444a54cdb8b", "comment": "Malware payload (Formbook)", "value": "0ba3ce972e41cfa1472519baedc8617b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438496, "uuid": "e20e5052-b656-437d-9b52-02eae5a6babf", "comment": "Malware payload (Formbook)", "value": "4371260390a2c516473f5b33c19b01b86256b7bdd2c318d4b55d2bbef70af1e4", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438496, "uuid": "df1d5974-a63d-40c7-a5c9-de88a9a6251f", "comment": "Malware payload (Formbook)", "value": "3051b45ca8e38960d4221f0cae35d22c3301caec", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438496, "uuid": "fed196e5-497b-4113-8320-21887350bc74", "comment": "Malware payload (Formbook)", "value": "586d1cda0fc4ed0baeeb5aecbb8ae5e1f54beaa41d75c079fdce6708f57655d9918dff3868c6ce24f8bf9ea641563afc", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438496, "uuid": "7ae1f2d6-bedf-4025-9552-fa82b0cf0d5b", "value": "T14A36AB1293F82218F6F7CF59697A20658AFABE166C39D13C21B4104D08F2E81DD75B7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438496, "uuid": "63e177e1-84de-43f0-964f-aa11c16eaa72", "value": "12288:h3IKg6D9H3zZT+upQh00CAZCmldv/1ri24PJyI/pyv5ASPwtp+O9iwlB3ox2V0Ta:tdEFt2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786438496, "uuid": "56897b07-0e7c-40ef-8c74-14edde85cf38", "value": 5224952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786438496, "uuid": "2ba24fd6-7b41-4630-8fd4-05fb42d0f7a7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438496, "uuid": "00e3e5d4-90c7-4dbc-9aa6-ad355c8f223a", "value": "Whatssap Image.jpg 11-8-26.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe6098b2-954e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786430193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786430193, "uuid": "93f680c8-8293-4856-9cbf-77707e2337de", "comment": "Malware payload (Formbook)", "value": "f19ff806c8a5ab05debcac8dc132a56d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786430193, "uuid": "d67d882e-27d6-4fb7-9493-9c4605918f0f", "comment": "Malware payload (Formbook)", "value": "440bc573a02ba11f5c7f309f251d9ff841c47284caf24210e519ef03ab380908", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786430193, "uuid": "01e0cc89-b613-4f67-aa96-0b1118c02af6", "comment": "Malware payload (Formbook)", "value": "b3ef3b03323a404ee424207f5f32531270489895", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786430193, "uuid": "431968dc-3b43-4500-8fdb-47a3780272ea", "comment": "Malware payload (Formbook)", "value": "f1635c6ca0a6aab1cc9d6f104fdb855dae5f2ea81dc1e87f7cdb997a7702a1e75768b3203ccce1515287eb60f6cd551e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786430193, "uuid": "e06278e9-a2c7-4a8b-b102-b54f23aa9589", "value": "T15C53CC84559329885737BBAFB32A98E4F3B617AB01914D17783C6450AFF1C09DDE0CBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786430193, "uuid": "2f3ba5e4-2306-4e79-baee-7eee5f1446a7", "value": "768:u6w5BZLp8F+lWUH3djkLqnZmSsKfKeiypu5qFux0Xrvomrp/WNs0q3mQfwxSvbx9:85ODJ1ePj0i8cm40E8OsXRO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786430193, "uuid": "698abcdc-8465-47ac-aa4a-749641a0f43a", "value": 62288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786430193, "uuid": "6c3e15ed-e62c-4448-a69c-f1c54480cbeb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786430193, "uuid": "aa895f74-1ca6-485d-83ed-4c151edea868", "value": "PSV TECHNICAL DATASHEET.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7bebdee-95b6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786474715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786474715, "uuid": "ea20b506-e1f8-42d1-a9ac-face685b4dc3", "comment": "Malware payload (Mirai)", "value": "26f80723d4ad067c4e127358466ef94e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786474715, "uuid": "b32926dd-e5be-4889-9d6f-882ac336a27c", "comment": "Malware payload (Mirai)", "value": "440da933aecc21a57dba92324eaef042d47aa94f4a042b4523bd8a75c13864c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786474715, "uuid": "b12aa937-4fc7-4105-aa41-5d145bddf8dc", "comment": "Malware payload (Mirai)", "value": "8365a123d520043ecb2e6993af537255dcb272e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786474715, "uuid": "7f61154f-989f-4e57-b91e-511caf1be19b", "comment": "Malware payload (Mirai)", "value": "fa9868639d4b6001dfe5bd445754421b36de7210631c9ccb710fb6b6f871c3620c2f3133dfaf952e6e6ff259fb29a56e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786474715, "uuid": "846e88b7-25d4-47e3-8aa6-ea854ac8d6ad", "value": "T117A3168ABC81E612C7C556B7FA1F518E330657D8E1EE3202DD255B603B8B81F0E6B785", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786474715, "uuid": "cd90cdd5-f4c5-4aae-a0ee-8dace86a978a", "value": "1536:YWBfW4pxvgvNrjS5jUlg+2jv/rnHEkOwGUhXmpOUOBXarcHnD0Y4qytjNjgUaqv6:zBfHxvurgXvjSU5QlOdogD0Y4nlkT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786474715, "uuid": "b3ce40a1-0b40-4f5b-aabb-6e509542dcd6", "value": 104512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786474715, "uuid": "62664318-a619-4c08-a95e-0869ef13c1c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786474715, "uuid": "a0f4dfad-4c92-412f-a12c-4c3eb985beb6", "value": "bot.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11e54cf7-958e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786457284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457284, "uuid": "51b58798-1fa8-4fb3-be90-3025c5539879", "comment": "Malware payload", "value": "bfbe88d116aa86d4233b34b11f8d28e1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457284, "uuid": "74b00484-2799-40b4-ac14-38d0bfa20154", "comment": "Malware payload", "value": "441b222b5d90fd75b55978bb187c709a766ead42110b038c6e1cfc18d57315ba", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457284, "uuid": "b990fa19-9d9a-403e-9e5e-4dcc96d5b326", "comment": "Malware payload", "value": "022b9bb5c5f2db66db71d40f715ab107053dafd0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457284, "uuid": "739bf7f1-135c-4c86-82fc-5ebc046decf0", "comment": "Malware payload", "value": "e38aa0b8eeefc18c0408447d6d49f0bc87cf5697120dfe334581a6bdb274db3d4de70c8e027d3bc5ede44a846b340ef7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457284, "uuid": "eefb7cdb-fea4-4a96-a57f-6f721e8e128e", "value": "T1244163C900544A382CF69B6E31EA4C58F3E1A1B720C19F8694F734F7404DE451D96EEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457284, "uuid": "cc8175b7-3437-45d0-a5c1-eb3ec694fc01", "value": "48:v0djM0sM9/0hdhjQ0hvk0CGT01rC0YgN0c8j0v5A0DVK0SWz0gYf03v35au:v0djM0sM9/0rNQ0hvk0CGT01rC0YgN0K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786457284, "uuid": "9d8fdbbd-77d8-404e-83c5-6a78d8dbe93c", "value": 2360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786457284, "uuid": "29946509-7470-4065-8733-fc0b91b00be9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457284, "uuid": "ddba1d3c-3837-4f54-a9f5-96177e506126", "value": "hnap", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba4da024-9561-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786438239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438239, "uuid": "7b3c89a8-54b5-4ea6-a457-5400e873bfb8", "comment": "Malware payload", "value": "22b657648d3ab0a60bdcddeda1f5f299", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438239, "uuid": "b390acd0-5ff5-44ef-a96f-344ed858469a", "comment": "Malware payload", "value": "443abeebff9d493c8abe3b20652ae01bffaaa4eeb70da9238220920a383340e4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438239, "uuid": "a8771d55-6165-4dd1-b93a-ec67a08932c1", "comment": "Malware payload", "value": "c243973c01c5fd8dabf234ddd5cff0c29fa6db71", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438239, "uuid": "19a7e320-ab00-466d-9be4-1f65bc293651", "comment": "Malware payload", "value": "c57fa6846e17930e7ea313bad4a256520808c84c3e0f09864dbfa8c237edbc260b0a64c6b1a396aaad5fe91348cd57d9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438239, "uuid": "b7352c54-37d3-4456-aaa8-86583a3bc03c", "value": "T12F4516A9754A416BEB34C95CFC8C2168FB6438090D485C2F76ED984103D27FA9CBE97E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438239, "uuid": "2284d775-8c63-47e2-86bd-5d6f0662aaf0", "value": "384:rv+br5vvZSrjclZevbrjSr++br+brbrNOevNOcljvvlZco5vvlovJr+br5vNOSrZ:0AMudyzsw4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786438239, "uuid": "df7720ce-6b26-467f-9416-de67c93cff32", "value": 1165369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786438239, "uuid": "e9e34373-f3f4-4f45-a1bb-0d5003c4d8f4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438239, "uuid": "cbfc6da9-24ec-417c-9cb3-41c5f14d566e", "value": "PO-01.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb73acd6-9561-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786438321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438321, "uuid": "8fb3b759-75ad-4b4d-88da-b4f3c9ac643e", "comment": "Malware payload (AsyncRAT)", "value": "bce095770ff255f4c37051de8cb9aeff", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438321, "uuid": "45452f40-1b89-4142-b353-bcb72fcf6fad", "comment": "Malware payload (AsyncRAT)", "value": "44421e9918f246c7bac565e429f7852d8347c1c91cbe583fbbf682b89f7b663b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438321, "uuid": "fe776c1e-8d5f-42a8-8665-cc7945365c2d", "comment": "Malware payload (AsyncRAT)", "value": "22fb59b6ab56d50ce10d63f362ccfe55e85fbcd1", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438321, "uuid": "e41b9096-ac77-4e19-a364-db13ecaed312", "comment": "Malware payload (AsyncRAT)", "value": "2a76050b3454296d0e6591c230b6237125753c46b97547d3509b855609398335edeaf845901fb3b15b6b5ae402c928c8", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438321, "uuid": "07c6567f-d4e8-43aa-9c7b-f2f088f44501", "value": "T1DEE418E226CF20462A15B36D944F6DD88F1E81314983D6C8B0EE46D44F5F4ABED90DBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438321, "uuid": "3623de88-c590-4d1d-85f1-f7142c08aacd", "value": "12288:KtijoE/SLNuZPAqBgxCRSIEo2bR21NULtwL:KgdkIBgxCkG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786438321, "uuid": "b1fe9c76-c330-4f49-8b93-7fa7eec68ee2", "value": 657355, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786438321, "uuid": "b12ef1d3-250e-4247-a396-6f87ba10ca36", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438321, "uuid": "5724d5d6-12ca-48fe-acae-44736fe8cb2d", "value": "Comprobante de pago - Banco BBVA.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b745067-957e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786450562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786450562, "uuid": "a0a183cb-3343-4763-9067-ee976942bd89", "comment": "Malware payload", "value": "0c0c2c044aa3f18a457da06281f4bd93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786450562, "uuid": "3762f281-a108-42e5-9270-cf44b4249322", "comment": "Malware payload", "value": "444ff869c90f8ad040cc150f72d01a0bac4d7232a97cc078f8e53773b9b50cf2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786450562, "uuid": "00764b89-6490-4e8b-b4e5-7ffde71e457e", "comment": "Malware payload", "value": "58b322c9783c3415ee8200d034f49196c6dd2eda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786450562, "uuid": "4ed46d3d-546e-4bd4-8de7-eabe9c0ad176", "comment": "Malware payload", "value": "606d53e19f24f6293ca0dd9f08bc15e47ecbdc21fffc4b549283eb33786a6aaafef6c660054516193d844ee226817211", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786450562, "uuid": "120d8a59-1f50-47ae-8911-df9224fce734", "value": "T117355E32D7F6A56253A0330EAD2A042EB7AD5CDD528355F7330EF4D07DDAA8112139BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786450562, "uuid": "64c34aed-3733-4e3a-8e9f-00e7641233b6", "value": "768:kKePA4KGpIvUiCUpINGpAPUiCA43gmgvUiuN+AI/mPU+UpIFielcKbpI3NiKKbCD:luZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786450562, "uuid": "78c31f7c-c832-42d7-ae01-8bd25a91a88f", "value": 1084983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786450562, "uuid": "184211d5-60a1-4ae7-810a-a064a32a60e0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786450562, "uuid": "f57795a9-0b18-44aa-a462-0168f29d68df", "value": "Comprobante de pago.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26cb2ba8-957b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1786449158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786449158, "uuid": "3b642fb4-79b7-4423-8491-4de4c71b8e49", "comment": "Malware payload (Efimer)", "value": "f0d05c88570547b428814d92a0d1797a", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786449158, "uuid": "b83e35d3-7bc3-4edb-9fb0-e848e74b1450", "comment": "Malware payload (Efimer)", "value": "446205b6c0302ec738b18e027d9343bf454bee9fc2c11672c80fd9d999c423a5", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786449158, "uuid": "fa64de6b-9055-47de-9ad9-381e23c7537b", "comment": "Malware payload (Efimer)", "value": "79c6581cf29fd6083b13a5845727eb3186340325", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786449158, "uuid": "803f9790-4692-445f-b1a1-9b94623b3935", "comment": "Malware payload (Efimer)", "value": "2b50a3fb7a090c8c039222b42be31e9b889b9d4f5dca542ca03a0751f74b0393a5a71214537bdbbef70560b9d7bc59e3", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786449158, "uuid": "569d4aa0-03d6-478e-b066-019c41673c15", "value": "T12BE633946EE002EEEC738039DEE34696B261F87A1B32C6CF576817652E572D00D38767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786449158, "uuid": "248986bb-176a-4629-9433-7ad0924b4b6d", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786449158, "uuid": "f26a82c7-38c1-432d-be9d-76606f4f0820", "value": "393216:o8ktqAEJX4OJLDEY/JWR3vXMCHWUjhcuI3/PGTAI:o8ktWJ9tR/JWR3vXMb82H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786449158, "uuid": "819bcdef-82f2-47a1-aa7d-47b96195e3b9", "value": 14027532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786449158, "uuid": "bed3815a-20b3-4241-b21e-eb21bd3ddedf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786449158, "uuid": "ec6ddf82-74ca-4d4e-92fc-ba98cc2c34dd", "value": "composer.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ee425a6-9579-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786448501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448501, "uuid": "e9a1cc91-6ef7-418b-8c78-d2b5485b8009", "comment": "Malware payload (Vidar)", "value": "6c9384c16d5e075784648b3ecc5a3a99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448501, "uuid": "b98d2acd-2d74-4823-928b-392055d351dc", "comment": "Malware payload (Vidar)", "value": "4493b6423e97855815f58fd5712eb9da07ea1255fb910e9841b59e083dd1c524", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448501, "uuid": "8999cced-cf8a-4aac-8385-a585baa42002", "comment": "Malware payload (Vidar)", "value": "fab3662528adf91f0c8e32d80f32c16b46f0cc32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448501, "uuid": "f0108776-fd0f-4404-b728-9fde984fe5e5", "comment": "Malware payload (Vidar)", "value": "d908533674b6aa0d487000862e713a456a3801d95003e38d69b7917c873882e2ada8a29091b28c9e2d3d15fc7ede33fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448501, "uuid": "ad885e4c-836c-45ea-a606-ba6a7f3305bf", "value": "T117768D1FACA089E7C8AA6231887F51127B79BC854B3247D7196372393F75AE0BC74790", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448501, "uuid": "1174fc76-023a-42ef-8b3c-59f201a3c098", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448501, "uuid": "83126ae2-0ce3-4d30-9c2a-4e8b8d1aa647", "value": "49152:Zf2kaDpQ2aTcDbsX5IXtTLFrIhdAC80PwmQaVanw:ZM+Ub7IhdxUw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786448501, "uuid": "70de666c-493e-4e8e-a137-16baade940b3", "value": 7173512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786448501, "uuid": "5c3970d3-930a-4758-9ed9-5c9471c905d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448501, "uuid": "3378f2ab-9ab0-4fb6-9a20-5fee64c7ba90", "value": "4493b6423e97855815f58fd5712eb9da07ea1255fb910e9841b59e083dd1c524.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a87172d-9560-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786437595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786437595, "uuid": "b08c7c47-8d39-4a2f-8132-9ab84bedb3ce", "comment": "Malware payload", "value": "3ec221dc76cfb4c69e37b733c47afcfc", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786437595, "uuid": "3aec2a4e-f4b4-4f9d-9ff7-4b6c3cfed62f", "comment": "Malware payload", "value": "44c735f51cf1f8da51f35c6a2a580f3422b77747357ac97619de9b43dd464edc", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786437595, "uuid": "065bd462-846e-444e-9536-7346777357d4", "comment": "Malware payload", "value": "ed1fdf1330b8e0c05fe702c3353338fcf0c38ff5", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786437595, "uuid": "6cacb7f9-ca7b-4b18-a719-837d82dd8c03", "comment": "Malware payload", "value": "cf5d98dba64fcea7ff7a80053e8bdc9a9c89ead738029d1f755add1320504d7eb786bd3b5965757f638b136985046c23", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786437595, "uuid": "6ec4684d-4e78-46b5-a58e-b7ab4cc6accd", "value": "T1C0331417FE100198C3F42B281E1680BD5F600EDEF48EDD192ABF6F566B515A68A0DDBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786437595, "uuid": "91d28b19-31da-4424-8217-09f33f7cdc0a", "value": "384:gobukyLaJ67QRF69ZBAAMJSbgrfH4VaMuRVaG1R0UJEcEmEOlCKvk:g71LaMka2PJEcEGvk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786437595, "uuid": "6ea3cd97-a2ac-4f33-91a2-b1a21d997ef7", "value": 52668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786437595, "uuid": "3a9807e2-f491-4b9d-bcea-590ce62f20b5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786437595, "uuid": "db396a63-4bf8-4c1b-8e72-b004bba06d94", "value": "wemadebestthingsforthebestpeoplescomingfromthelife.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43832c56-95bc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786477124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477124, "uuid": "8d9666df-d1c5-42d8-acb4-7b994c4fd140", "comment": "Malware payload", "value": "1da48686908f9535d7123713deddbd7f", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477124, "uuid": "63fa283f-1f63-40e8-810d-0c9cdedef2f3", "comment": "Malware payload", "value": "44f9d5c684fb6f34465cd7593709a37cadb57aaf41430b0d043fa593e4faacab", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477124, "uuid": "b921a166-d0ad-4137-ae8f-1d9bf0f60bbe", "comment": "Malware payload", "value": "7f6982bb0b21b1d4ef0b8a21e5a7ddc7dfc4b09b", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477124, "uuid": "a67d4c9c-8433-4cc5-8844-9fab53d105dc", "comment": "Malware payload", "value": "92582c4ef4d18d91ebe42dd56caa113949866b8259bf0d960a0c6adafd32facaf51edb6519f0500725799e59bd9b6fb5", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786477124, "uuid": "8a6f6620-cc25-4c8d-85bb-78d301682f91", "value": "T1C896225AFB05D09EC0FA42364A350266150B1D6A8E83E7875959733C1DBBAC08F6BFCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786477124, "uuid": "d1016f1f-a852-4cf1-9d49-ec3eb4c18ff8", "value": "196608:9KVxAgmf7PFRljf+yW+QxiXqKIeN4UbhwCBZa3q:EC7xfbW/XOThwQZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786477124, "uuid": "fa439697-c4f1-4f3c-ba8c-4119857be695", "value": 8775325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786477124, "uuid": "a43a57fc-6719-4012-a94b-a0b164b4da14", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786477124, "uuid": "7d3572eb-713b-439a-bb64-325f990ccf19", "value": "TikTok18.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc143234-95cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786483876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786483876, "uuid": "72099628-d130-459d-ab5d-fbae457ad89a", "comment": "Malware payload (Vidar)", "value": "9b404d3614dc13a9d8038b4f1f3ccdf8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786483876, "uuid": "7fabc3db-ea73-487d-89ae-b0108bb9fff7", "comment": "Malware payload (Vidar)", "value": "4585d96e251a5d68b2e4e7d77c66d55265128a07a635baed90be8d1a04c85ef9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786483876, "uuid": "03074791-b2dd-45ad-95ca-097b1187ead0", "comment": "Malware payload (Vidar)", "value": "65ba04ac8df52e12f01db6108ff7130162883c4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786483876, "uuid": "cb74b03a-5165-41b6-a8b1-6a68520ee845", "comment": "Malware payload (Vidar)", "value": "620f22aa462542ce8021a6f9318afe78b7283bafe56136f1451b7355e0bbe10b017d136d503735e9b5817b8c4173e34f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786483876, "uuid": "bb21180e-dc48-4608-87c3-3ef0e0a731ea", "value": "T1BBF58C07BD9148E9C09AA33189B7925A7B75BC480F3223E72E506BB83F727D01D36B55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786483876, "uuid": "5d233b88-8991-4841-86af-fdbcad335a61", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786483876, "uuid": "93a70878-08e6-47ad-b00e-64d577fa1c9e", "value": "49152:pDkfFQyuAID+c3dnQRANWXIamnaVxVn/5YrPXGdtI:pokDoJ/VL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786483876, "uuid": "4912489d-4224-43b6-b0b5-5bcde82cc828", "value": 3581440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786483876, "uuid": "ef431184-378c-4086-adb9-114a74e98322", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786483876, "uuid": "a05d73d9-32c8-4c9f-8132-4ce1bf15ccb8", "value": "4585d96e251a5d68b2e4e7d77c66d55265128a07a635baed90be8d1a04c85ef9.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90ce3292-954e-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1786430009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786430009, "uuid": "d58d1d5f-5853-48c7-b9da-3284b8b6f81a", "comment": "Malware payload (XWorm)", "value": "fcf18d323bc54aba9db65d5f24d4c252", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786430009, "uuid": "43de0a66-b6d9-4d5b-a04f-a787fd6632ec", "comment": "Malware payload (XWorm)", "value": "45b1296b5c7de2b1a159bfb7d91cf4186d8b076452c9d683174ea47dad1ed5b1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786430009, "uuid": "2b240d05-a396-4797-9ebe-c64fd1946dce", "comment": "Malware payload (XWorm)", "value": "e1b4f9d17a87c53adaf5b9390082802b356a4010", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786430009, "uuid": "4b820cab-9b5c-4cb4-933c-9ba15e0c9ce9", "comment": "Malware payload (XWorm)", "value": "fa3c3acaee2271afea0ee12d1cfc6479903bec2e128dbd9ab864cff3eeb09c7c844a89b6a88d1ba1366b625bda254245", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786430009, "uuid": "139c1331-bd89-40a5-934b-14a0d6ed454d", "value": "T1C2B5D6105708AC70BA7E672CD136AAE0861921071185EF2F357C7644B7EEE27A79C9F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786430009, "uuid": "b6fa6c9f-5fc1-4abd-8797-2893eb5e1783", "value": "49152:cOTwyZ/Mo6X8xNSb1X6uiYH2334i6LKzV+KLKAvsSMiPeWWzsjdiI+StM:/wyZ/NYEkbniYHM34il+UKA0biPeWWzr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786430009, "uuid": "4898e871-8a00-4bef-8822-9d61d2946782", "value": 2271838, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786430009, "uuid": "b375bcbd-51c5-4a03-9522-bb54b28b9fd8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786430009, "uuid": "06074858-44bf-4fa7-a872-6f80d305a28e", "value": "XSCAN-POB260728157.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a08b5c20-9579-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786448504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448504, "uuid": "58ee587e-857c-4b5e-b655-1827dfc99002", "comment": "Malware payload (Vidar)", "value": "b6c479ace3c7d0349b00ba40d4bf6702", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448504, "uuid": "9ee1cef9-90bf-4603-99bc-c397ed9be504", "comment": "Malware payload (Vidar)", "value": "461a08f66db15d4fe02efbe4855091118732695a1bc8a3a3a1f1473d072d84ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448504, "uuid": "a6bb23f4-0df4-4037-8cac-bd39c79e6abf", "comment": "Malware payload (Vidar)", "value": "41d7bdf2af65b047434770c46dac40222c38c4da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448504, "uuid": "1513e0b5-3472-4e35-8da7-06c387582bd5", "comment": "Malware payload (Vidar)", "value": "406622b9bb3ba5167295fbf7319cff24a5aee729d4863354dc09ec9622dcf260470934424bc21345955d99148aa89c9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448504, "uuid": "02930719-fa3a-4497-a215-eadab001157a", "value": "T1D6866C17ECA145E9C0AAA63185B39253BFB47C495B3223D32B50F7392E72BD06E79710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448504, "uuid": "00097e7f-802e-4a9f-a665-901570d83c38", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448504, "uuid": "90d6ad42-bb12-4438-8b25-29ed6222ed2e", "value": "98304:MHXnLVlqG98+01gRladAqsaBqtjoVoP+dUUZEy:MXWG9701gCdA48oVs3U6y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786448504, "uuid": "9a4ac816-1df5-44c3-beea-8de59cae980b", "value": 8240552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786448504, "uuid": "a77eb0ca-8429-4b50-8be9-053bb78c817f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448504, "uuid": "8627b366-4fc9-4b20-b001-54a1c1d1fae6", "value": "461a08f66db15d4fe02efbe4855091118732695a1bc8a3a3a1f1473d072d84ea.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b98e6c44-95c2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786479899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786479899, "uuid": "f4b1c06f-33c9-4199-8336-7d5f93271fb3", "comment": "Malware payload (Vidar)", "value": "d8143bac2fea71a80cac8b3a6ba70eaf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786479899, "uuid": "daf63fec-e731-4c42-922c-35aee66598a9", "comment": "Malware payload (Vidar)", "value": "4648418dc95b2883d5320fd22244762252e825121498ce43d8c7a1b33a455544", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786479899, "uuid": "c75bc162-6f39-4f03-9880-c76f02651b5c", "comment": "Malware payload (Vidar)", "value": "c1233ba36d0d9f5067c61fbf803fdb7556675e85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786479899, "uuid": "a31a601b-3b82-4b26-9f32-69f34ac87df5", "comment": "Malware payload (Vidar)", "value": "27f8eb48576ef0e15be0e14e9c79cd47e84033be04ffc20f805f428bcba66e2c0411c1c3c673f83a62363f0a02eab927", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786479899, "uuid": "8b395155-1e27-425b-ae42-bba5e93c60b0", "value": "T1D5166B07BC9548FAD0A5E33189B74252BA64BC4C5B3133D72E60AEB82F727D0AD35B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786479899, "uuid": "491f7282-95ee-4034-8834-50d1f18c93c7", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786479899, "uuid": "63d98b22-39db-4002-81dd-b7b0e0012e84", "value": "49152:sKoNrKGU/G9VJvfzF+2a/NWdKqK9rx9GnIFpgwUZ:slxPDQ2pyZFp56", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786479899, "uuid": "e908bee0-1c44-4b8c-a47c-7681691be67c", "value": 4196224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786479899, "uuid": "79a2bbfd-480a-4d96-a439-19b1931d6536", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786479899, "uuid": "457b56d7-dee0-4f13-b3b7-5f702716e39a", "value": "4648418dc95b2883d5320fd22244762252e825121498ce43d8c7a1b33a455544.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3cf4559-9562-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786438738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438738, "uuid": "dcf3ba19-d97f-47cc-a561-3019da6729b4", "comment": "Malware payload (Formbook)", "value": "7b288fa9547c38f3c3468bb14c8ef3b6", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438738, "uuid": "869c0bfa-0c24-4918-88ca-a53355551e7c", "comment": "Malware payload (Formbook)", "value": "464ec2b347c0ed331ce40d716f42ba007f2b5d81737d17cdaaa9de50394d2599", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438738, "uuid": "c31c6d37-045a-45d4-b97f-a70d171212b8", "comment": "Malware payload (Formbook)", "value": "5d1d0f52554648c47ca7039aa457a875013a79d6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438738, "uuid": "2a818f14-52c3-4da9-900e-696ace635c71", "comment": "Malware payload (Formbook)", "value": "f9f174f5e6f0cbfece9bc0d59c1f581dcfecbd3ed0b0c69d7c7461840dfc637e4f4574815cb8291cf4b497de798e6863", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438738, "uuid": "d2c49c32-be87-4f43-9b3d-c51a2032cd96", "value": "T10656D8B299DFA38999403B7D925E5644070FCAA16C97A1C464CF2FEC970F44B33E894E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438738, "uuid": "834a9707-75d6-429b-a309-95657044e6e7", "value": "49152:u+4v2u8BJS0gsbJQhT+aKFJvcCO1YFCJ1GQfvMKXyRq6/PeualQ95MGbGGl5aE4W:J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786438738, "uuid": "9a5c51d5-ff61-4ecb-86ca-14d438ccb390", "value": 6150361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786438738, "uuid": "3a55b22a-0db4-4980-8e5b-8fcce6991431", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438738, "uuid": "44f3062e-f776-411b-b8bb-033c7d53e0ef", "value": "DQUBE ORDER REQUEST QUOTATION.PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4ca823b-95df-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786492400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786492400, "uuid": "97ee0c0e-6729-4973-907b-43c858fbcd27", "comment": "Malware payload", "value": "94b3457f738b6da764d27630ef344f5e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786492400, "uuid": "8d9e2c2b-7f93-4ca8-adfa-d6f4b5572779", "comment": "Malware payload", "value": "46675245b4ba01fcb2e45b520290f6d7ca0d2123bf5f207b6d16dd14a05a6272", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786492400, "uuid": "0b621347-f1bf-4818-958e-3a094b6e004e", "comment": "Malware payload", "value": "239fc5676329bfe8629b2f809fafeb1c3b4d5396", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786492400, "uuid": "4f386b0b-6cc7-408c-8d84-335f7c9eca3b", "comment": "Malware payload", "value": "3301b8bb0f55b182437083f0fa3dc45a224ffe40a095cda1cc9c1894bf41e45eec6584646ca9b0fba3c5389cb67e935e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786492400, "uuid": "9917824e-5ca9-48b6-beac-c767700c245e", "value": "T1DAE6334CF58CD859C8DE76B2C7E3CE220182C96132E9CA19B5D6A842AC327C9DD1FF51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786492400, "uuid": "da1bcf71-cc9e-438d-9258-ea1dfacec258", "value": "393216:z9pcAlUPlOnp7fnBC4jAxUK1XAwzZ9BDE7ji:z9pRCMfg4kB/Lq7ji", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786492400, "uuid": "da4bcafa-82c9-4827-90d6-4dfbde537392", "value": 15017585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786492400, "uuid": "2231d3e7-c7ff-4154-96d6-ab7bdcd3bfc6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786492400, "uuid": "1aa22bb2-dc82-4635-9983-04f71b37a7b7", "value": "netutils.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49d325da-955e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786436762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436762, "uuid": "bbc4ef1b-5328-41ec-82e9-30918f9d015f", "comment": "Malware payload", "value": "b92924d546d4b386c65deb4f66f73554", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436762, "uuid": "750376f3-bfa6-4ed1-9694-668479a26966", "comment": "Malware payload", "value": "46ac8cd2c1a6efccaed8a56348f92aed29bb5042974d544a7d4cc6934f1c46a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436762, "uuid": "dbad92e8-968e-44c2-bc02-e8569c97e17c", "comment": "Malware payload", "value": "c8a841607b585aa118f5280e8689cdd871b59512", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436762, "uuid": "6f436acf-313a-4c4c-8266-3135be8a1cb5", "comment": "Malware payload", "value": "e33212451168ff1e5f30c0a99dadb6811d35624dbfed061b43b713d176b1180123fc464dbdaf42cef6d505414492b02b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436762, "uuid": "dddcc4e9-9c79-4370-9791-b0147b66d80c", "value": "T1A6E52398BDD236B5E476C7B7875375EEB12C379485B08C4E27883B106E129293C3736A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436762, "uuid": "df8db14b-81f1-43ea-9ceb-9a4a2dd094b2", "value": "1799eb3c1092391ae174afa4eee4cba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436762, "uuid": "6459f243-3a0b-4f26-9c80-8f3cefdcce27", "value": "49152:Z1wo+Xu2VH02fAR074sUNL1oIllcSV5txiwCuWCaklZpc3P7gclL:ZEMtsUHoUlFXiHRGpc3Tl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786436762, "uuid": "fe9fdad2-9713-41ee-a85c-6ca931501b40", "value": 3022336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786436762, "uuid": "70dd16a5-c151-4006-9386-0e7037815e12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436762, "uuid": "fb5f1764-5815-4fa2-8901-2abe96a9ef4f", "value": "gM9anpOuZNKX8zHj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f6c5b50-95a1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786465440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786465440, "uuid": "2231472f-4ac3-42a8-be11-cf7b3a8132cd", "comment": "Malware payload", "value": "b6ee33fb7d4c899b349c519e0d983a86", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786465440, "uuid": "ab1fbd8b-0c1d-40e8-a462-74f475d17de3", "comment": "Malware payload", "value": "46d533fad59ef99cfc3b821a67bd41eaed562b4c4342c8f5feaa2455abf55399", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786465440, "uuid": "c4d8a663-1ebb-4f68-b39c-251b827f3e80", "comment": "Malware payload", "value": "628957005efa678cc6f59a22e321360c077494c0", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786465440, "uuid": "3f271b8c-9f0a-4c7a-87c3-6fbca3938352", "comment": "Malware payload", "value": "d91f62f577cd76f1b434b28d4b8070842f650fcca761313604ced7291bfebb4143c1585bbe2254dc2da1c07f56c03dc7", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786465440, "uuid": "bcaa9621-08e8-4623-912c-e5ba571b8403", "value": "T1DE229605E815153AE7834C5DBE8AED145BA62C4B15482C38BBAC92E94FC0436D7F8DBF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786465440, "uuid": "6ad317ed-0f1d-4628-9579-3349c861f5e5", "value": "192:K/VwolPa2GLsZb7oicplbmlbyQUgqs70gM9dA8sBEkFhkkdCcbDaGKnmukgUNGqj:GWFsFcAQkpUTYhkkQcbDaGKnmuBUNGiF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786465440, "uuid": "5c6f4948-7009-409b-ba93-9786074ee531", "value": 10701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786465440, "uuid": "af418d72-9a83-4d68-9e1d-850a8f680958", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786465440, "uuid": "28fe5e30-1d8a-4bdf-9d61-193bc83b6103", "value": "coldcard_final.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cd354b5-95be-11f1-bd95-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1786478106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786478106, "uuid": "0fe57b58-e996-42de-a487-8ba0272c7285", "comment": "Malware payload (njrat)", "value": "1bcd29216ad89165683a7e00dec6b2ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786478106, "uuid": "c9deff1d-83a7-41b3-bfcb-030506f6dcf3", "comment": "Malware payload (njrat)", "value": "46e9d345a244b8859368e39ea83dae7bd2f6db504372e0f3986e2505cf54171f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786478106, "uuid": "d26bbf98-a194-4437-964b-73151eb0f600", "comment": "Malware payload (njrat)", "value": "549810f7198787ae43a07e32e9db83dc10a4232f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786478106, "uuid": "8a5d3425-2fe0-48f1-8f9b-e8aea16f9c6b", "comment": "Malware payload (njrat)", "value": "49407e22e4078bf4978b973920e8905ec2c85ccc7b9a47d0eaf15a988be9d9cd47682877243eb3b4094cbe290dfd24d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786478106, "uuid": "6e4ab6e1-5f89-41ba-87fb-ae9ed995f94b", "value": "T136431A0D7BD44944D6BD4BBF94F140120778EC43A632FA1E4AD6A49A3B337D98E08BB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786478106, "uuid": "92feb10f-93b2-4989-920b-c17da0adfe53", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786478106, "uuid": "510bde57-e1b9-4738-96a7-d590771708e6", "value": "768:qQqTXesn+ht5iTThaPWsBLpoE2rXb/FwwwECl9Z4DYPEbL7XfSxI3pmfOe:1un+LITTJsByxLd1wl0DbXaxI3pmfOe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786478106, "uuid": "54a6553a-0f59-4d0e-ab4f-1a02cc3fc667", "value": 60416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786478106, "uuid": "2ccd7ecb-b756-400c-9cfd-a994445cd9b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786478106, "uuid": "f316d8a0-6a14-4b6a-9f07-a60322240502", "value": "1bcd29216ad89165683a7e00dec6b2ab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58ce8f4f-9592-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786459121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786459121, "uuid": "8df3e6f4-6f86-4135-8a78-7ab6fde52d0b", "comment": "Malware payload", "value": "aeafc8a356bbb81b14515c18a11b56a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786459121, "uuid": "54075130-ed94-43d4-952e-1ef5b09a9846", "comment": "Malware payload", "value": "46ebc6174365b2c48aececd5515f572151a84b07b7cb7c1485f1a906c32acdd4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786459121, "uuid": "d5945e48-ae4a-495b-9c96-ccbb3ade9262", "comment": "Malware payload", "value": "027ed3c92ab00f674fbd72681a8b0c1077310fd0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786459121, "uuid": "4a39ab4f-ce8e-4c9d-b7d5-1ca1e06cab5f", "comment": "Malware payload", "value": "f3208225f54687e064caf497cd2d136bb7189652246a5cb4706873cf3877e6b898fc6e550a61472b98c89b85d99d3b4c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786459121, "uuid": "6e4002e8-c101-4006-a93d-8cccdd6f3442", "value": "T19813F946FA519B05C6D232BAFB8E414E37136F68E7ED32319D306FE013826E71A39525", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786459121, "uuid": "c7263aaf-5c9b-493b-9ff1-4260b429e07c", "value": "768:jRnTC4tXIvB//PfFpJUNUB3D0mEwVjZCY1kirY9fDltnOaVf6Iz:jRn1lIvB/X/JzB3VDVjjkirYlDlt+Iz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786459121, "uuid": "1e11993c-3211-4507-9a46-cafc3c760217", "value": 45152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786459121, "uuid": "545569d0-ee4e-4d67-bfaf-fecc1b8d2ed0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786459121, "uuid": "164a3c7b-7e31-4ea8-8ebb-9b736094a0ba", "value": "main.armv6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2b59693-9591-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786458815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458815, "uuid": "19a0c558-f998-4676-b7d5-dbacea4f2f9b", "comment": "Malware payload", "value": "0b1412d18561bddb193ffefd1087d429", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458815, "uuid": "b46597ca-6e81-40d1-b21a-c6542b161d59", "comment": "Malware payload", "value": "4738611d135155f0f294436bff567fcc7bd26f11a29c59ce449a8efb8ccde3cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458815, "uuid": "dbdda237-2988-4327-b34c-27185382fa9c", "comment": "Malware payload", "value": "2c10d996a9dc8172f5585f2ad581bfae24a82782", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458815, "uuid": "73e9c851-5762-4b87-b2b7-3bd7355a00dd", "comment": "Malware payload", "value": "ff77b5c22f8e661e9540088824327c3cd58440407ec272be90eeac4bd1227b00ec92070b5b9309a71acb5d81b3492b44", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458815, "uuid": "90ae4fed-6ed1-4ef2-8874-36babe80925c", "value": "T10D531994F884D675CBD031BAF71E029D73130FA8D2EA31158E21AA3577F79194E3BA42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458815, "uuid": "4d29857d-3402-45d3-96f7-d5ab67a031a3", "value": "1536:UAkANKdoCz2ja08MhocJpXfP3tO1TgS8TlLcpS6jxVMsf5W4m/uek0r:UAFYcH/te0S8NcpLfuueR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786458815, "uuid": "034804b0-a09a-4994-a76f-e006c2eb48e2", "value": 66448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786458815, "uuid": "913fef46-c60f-442a-9981-e8bc1b947f59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458815, "uuid": "adb180b0-41b7-4892-bf74-dcbd999c62ba", "value": "main.armv6-eabihf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "249f7c41-958e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786457315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457315, "uuid": "286a0c83-1ac0-4ba1-963d-f6a6805812ed", "comment": "Malware payload (Mirai)", "value": "e17c87b0d90a6c78f1dad2c51bafca21", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457315, "uuid": "d992efe4-2fcd-4389-82c0-47fa357ff943", "comment": "Malware payload (Mirai)", "value": "475f53171f4ba2507a5f493bd5ea44685b1f129458548ad1b5518fc86ce9b202", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457315, "uuid": "53dc2d70-2033-4c85-a9c2-18743ce993bb", "comment": "Malware payload (Mirai)", "value": "ea0722aeee8aa63f44416b62f6ee91e0d31432e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457315, "uuid": "91337aa9-cc4b-454d-b642-c17d9fe119e5", "comment": "Malware payload (Mirai)", "value": "5ce8bf14d225724e99a18e5fd36499c642dfa7c3a9e53b9e387c38f0e6aea8b61db53d88c9fa3685d1f2333f8963abbb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457315, "uuid": "39ca54aa-079e-4073-aeb1-d6ca9808ff1f", "value": "T1AD84B062D474AD95C0232274B8B1DF384F22B85860835EA7E6EADA7144A3DC8F7747B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457315, "uuid": "45c079e2-fa6c-460e-a29d-4c81daa92951", "value": "6144:Qnidtdrw3irfNxhnFu1f3WntyCDKywN3AIzynJTKqrCJy/10DKV4KbUWaE:aidtd8uhnk1P5yQ3ST1rFmDg4Ua", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786457315, "uuid": "a9bd053b-7bff-4bc8-8fb0-6577ee6adab3", "value": 391396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786457315, "uuid": "6c8fd53e-0961-42f3-bfbe-e26e3b200a5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457315, "uuid": "028bc282-8e36-48ac-8878-02982c09eda3", "value": "sys64.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cdca39f-9532-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786417923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786417923, "uuid": "1b90f443-cd9b-48d2-b25a-2acb5770da65", "comment": "Malware payload", "value": "852e29f8e4c25091dc25396ddfe70466", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786417923, "uuid": "e7de6008-6632-4b9b-bc37-a17e1feb5af3", "comment": "Malware payload", "value": "47bef4639e4847e5e2cba99dd245a62645d1951e5b54bdc942376af3ccec0909", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786417923, "uuid": "5fb35010-b6c5-40c4-bc00-d1ff1504f821", "comment": "Malware payload", "value": "d4c8ed46df4f0ccc188abf3a33016212233d4341", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786417923, "uuid": "f1648ec3-45a3-46c5-84a8-98fc64c566cc", "comment": "Malware payload", "value": "2bd0eced918820a80cb9bdfe93a1cbfc19aed19e6b7d42464dc4df192434f79beaa7e463fc6221ece70c875242488b86", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786417923, "uuid": "3111cc9d-eeea-4fa4-bc1f-7bca5382adf9", "value": "T14953081BB5E3B0BCC297C0745A5AD9B2B9317CA102213E7F97C8FA312E35E012759A71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786417923, "uuid": "43ae0439-0e34-4fcd-a4e2-03f5ced1133f", "value": "1536:goUpWz/ZrJjS7G0kOxok/ZOQeh37ygor6kNz2Ur:godpJjSy9Oeh+rV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786417923, "uuid": "f018370c-9cf9-4c56-a394-6464a096dcb5", "value": 66640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786417923, "uuid": "85803523-8639-4435-8a1f-1a43141c68bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786417923, "uuid": "211f73f1-2050-4387-be76-6f59f07006db", "value": "main.x86-64-v4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4f33c19-958c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786456725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456725, "uuid": "7e63ef9d-9b82-48c5-886e-e5a66d0ef315", "comment": "Malware payload (Mirai)", "value": "3cd83ec88cb7bbc4d7b771d4fffc83fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456725, "uuid": "6cc424f2-eaf2-4de2-8bf5-81704ba9bfef", "comment": "Malware payload (Mirai)", "value": "47c1bf90182c9aebbaa84b5f256da89f5c3b1f175282717fbc9be6a7dcd618c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456725, "uuid": "6bdba5d7-be66-4cdd-a490-f25ffe3dec17", "comment": "Malware payload (Mirai)", "value": "ba6f1c1dacd866795919f600999845b82433808b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456725, "uuid": "184e28c0-13d8-46a1-81b5-99a975483f16", "comment": "Malware payload (Mirai)", "value": "a87b9a914eba78d3b0f734ffdac2b9d0c21ba923b7185c4b8886a2789a5e019e90cc42ffd03844bedf6b0ef52f51038c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786456725, "uuid": "af070627-4b3b-4c53-9ebb-bc8e2600add3", "value": "T14275E082F7EA2C2ECDB785764F5B83351703AD16CA53D787A954322CA87B6C44E58BC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786456725, "uuid": "2f453d84-df5f-41bb-a497-8bbab8c83d83", "value": "24576:P/n9P/oPEJ4OeOdReCgbKdlmA0Ii0LgAfnKpWPqkwUEj3rb/g/RiZ88bn:39Pi9rOqZbab0Idg4GWPszPb/g/C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786456725, "uuid": "ebd3c70c-279d-4cc9-bf90-8acb815d958a", "value": 1674768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786456725, "uuid": "4e91c168-ab5b-43f0-8f86-bf0f1e98d31b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786456725, "uuid": "587552c7-93bf-4a64-a3a7-9deacb5c36d8", "value": "Sgsa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac14ddf0-9526-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786412875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786412875, "uuid": "5c32d98c-ee85-4e53-8f32-84f454b8bf98", "comment": "Malware payload", "value": "8cc157d97fd7e0f2135a2bf3c2576557", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786412875, "uuid": "f3d7a67d-97ac-40d5-b583-b6a8648e68f6", "comment": "Malware payload", "value": "47da0746c7cd0150c953739c3232dba9a0ab71871ee12dfd60dc7f29a9cdff27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786412875, "uuid": "abf76568-610e-429b-b110-e36e3d7ab88e", "comment": "Malware payload", "value": "0f7edf9d0e57f52a5a6fd1d52d4eb0843009070e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786412875, "uuid": "83d71cfe-155e-4524-8756-14bf4bdce34b", "comment": "Malware payload", "value": "8842cb57f84020af2ddd7efa4809dda790493f5247d5673d176761afb743cccdb0a15e185d78f0928b692179291b06f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786412875, "uuid": "dd915a14-19c1-4a71-a531-51b8f955e564", "value": "T1E7D34C73B7099F63CA3D52B54EF2CA3996E1264119E2A0956312DF0C7E312693C3EDE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786412875, "uuid": "e9cead0a-bb05-4a9f-89f6-ea43bcdd65ec", "value": "1536:+VkabNEr+N8HliWukcNzndZuCnnLnQwQ23xbHEpEOWgyRFZ3d+rrrn:eN8FiWdcFdECLQwbxbH0WD3gfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786412875, "uuid": "53f42c57-38a9-47f4-8bfb-8f1e4a954312", "value": 140260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786412875, "uuid": "d2d0ad5f-593b-49f3-a795-22c6042ad011", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786412875, "uuid": "e9b6a13a-aab8-466e-926f-e04ba2ddc8b4", "value": "main.mips64-n32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f1d9e99-95ad-11f1-bd95-42010a9c0009", "comment": "Malware payload (OverlordRAT)", "timestamp": 1786470781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786470781, "uuid": "366abeca-925e-4f7a-99c9-b347ce74cfbc", "comment": "Malware payload (OverlordRAT)", "value": "1a0526f66a98675626a8620a0c2a9833", "object_relation": "md5", "Tag": [ { "name": "download-windows-update-live", "colour": "#993411", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786470781, "uuid": "4ab97dd2-89dc-46bf-b4ea-ddfa065f345c", "comment": "Malware payload (OverlordRAT)", "value": "485210b786a26125ac3f3a54addd85a9497ec3529e6f1f5a188097ac4c387a7a", "object_relation": "sha256", "Tag": [ { "name": "download-windows-update-live", "colour": "#993411", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786470781, "uuid": "2121b620-3490-4099-afdd-df67e0344633", "comment": "Malware payload (OverlordRAT)", "value": "b529435b701992773ec13461be4b56227a6af223", "object_relation": "sha1", "Tag": [ { "name": "download-windows-update-live", "colour": "#993411", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786470781, "uuid": "32e9cd33-7f38-4419-a89d-a2a1d27dd17b", "comment": "Malware payload (OverlordRAT)", "value": "efaeeafe551fe1a3517ec8c13d7963f1d7d8d939eb704aae540165bc08a19d3d3c969d8af80540d994efc2d20fd64124", "object_relation": "sha3-384", "Tag": [ { "name": "download-windows-update-live", "colour": "#993411", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786470781, "uuid": "053872dc-4c95-41f9-bd07-1fdfba2c2fc9", "value": "T14FC633990254DE04EE6A0FF05C20E37507F82DEF5A11D309AEF56DEF7812BA9485839B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786470781, "uuid": "05593d1d-1daa-44bb-9529-37e07c1b955d", "value": "196608:Wg1+L2k6X4gEdScw1XAPtU+7hUqBEOnFsFqMMrWwtoIqlACzSfOda1VshohVqCfJ:ffHUdScwAU+7h1jFsqawC3ACGfOdoVs9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786470781, "uuid": "59262c3b-0f16-4690-9a93-b11e63b0da72", "value": 12216832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786470781, "uuid": "71c068f0-de77-4ae2-9bfa-5ca2306e7aba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786470781, "uuid": "b4866bb1-7723-4053-a0ec-50e6177aa3b6", "value": "AQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f0eb4ed-958e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786457306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457306, "uuid": "42b38dc4-bd65-4270-916b-c7ca1a6ee943", "comment": "Malware payload", "value": "f88e354471fff40accb70eee5ccab256", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457306, "uuid": "32519b0a-476e-4c2d-9a7a-1ebb330e50a8", "comment": "Malware payload", "value": "489adbabbb9fc06f579b0ac2901fc0965616527bef9442591e5b5b49bee0ba9d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457306, "uuid": "c90fbe9b-31f7-44b0-8912-4dacd841113f", "comment": "Malware payload", "value": "a9afd9a6ca6de83cb5c92261bb811a7c92a70e61", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457306, "uuid": "615a335a-38f2-4e33-9aea-b031de3a3c22", "comment": "Malware payload", "value": "a59dc56d0ae521ec50c57839a7059fc99c88a508320d0c9cb417755082889bfc37330fbbd6010cde6ca4c74811552a3f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457306, "uuid": "2e18b97c-215e-4416-8a0e-8153a7c44b1e", "value": "T16741B8C910954A382CF69F3E31E64C58F3A1A0B720D59F8694F734B7804DE551D92EDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457306, "uuid": "f3ff6db5-d78f-4c4b-b635-feead1aa3982", "value": "48:v0djB90sM9G90hdhjl90hvp90CG6901rj90Yg490c8K90v5V90DVb90SWa90gYmv:v0djB90sM9G90rNl90hvp90CG6901rj7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786457306, "uuid": "d456271d-687a-4f19-8ed3-f2562037d0ab", "value": 2412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786457306, "uuid": "43c93396-a00a-4802-8661-fbe0df9f7221", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457306, "uuid": "a43f8ad7-52f4-47f9-955a-5d945625036a", "value": "thinkphp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "317374ba-9565-11f1-bd95-42010a9c0009", "comment": "Malware payload (LxBaseRAT)", "timestamp": 1786439727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786439727, "uuid": "f2a2316a-1d66-4382-a8bf-b9aa6aa47841", "comment": "Malware payload (LxBaseRAT)", "value": "36b83f39d65bf13b68adb626dd9b2672", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786439727, "uuid": "f7172906-aa73-41ce-83fc-97a1929c9874", "comment": "Malware payload (LxBaseRAT)", "value": "48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786439727, "uuid": "aa8ec3d6-65bd-4191-a04a-52948230438a", "comment": "Malware payload (LxBaseRAT)", "value": "0234ffa81b292445b9e710591cd8ff0155b4d1b7", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786439727, "uuid": "299a3c96-9798-457d-a4e2-231eb4d777a0", "comment": "Malware payload (LxBaseRAT)", "value": "6b524befc9b7291ff708885ba70fea37ed4173408cedeffc1b39aaf34ce059ba9182da483a3313cd13acc7142af0ed85", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786439727, "uuid": "ac950344-4e5c-49ff-acc2-3077c51faccd", "value": "T10BE5795203850BBDF69D0EC4C95B251B21F2E9677D241298EBB32EE7BC3F9849434636", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786439727, "uuid": "30d2aa6c-d267-4d27-a706-368ce583bb43", "value": "6144:QzOISBFpXmFQCc+vWshBj3OcdU5ezFdBXu:cimFQCh7jBXu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786439727, "uuid": "1780771c-217e-4f19-b700-69a15722cf02", "value": 3151522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786439727, "uuid": "f5063034-1df0-4a7c-bab9-671267340389", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786439727, "uuid": "efb25c48-bbf5-4d3b-aa06-f68399ded865", "value": "Angebotsanfrage_11-Aug-2026.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6102aa01-952d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786415755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786415755, "uuid": "9af9dd9b-6d3a-4f41-a2b0-3818226587f3", "comment": "Malware payload", "value": "af9a14a7f2d937197a97ac483f81f7b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786415755, "uuid": "6132c8c0-2e4c-4b30-87cd-a3c72c25fbd3", "comment": "Malware payload", "value": "48f74ddc197eba0bf1ff8d01da72cfa8d2f864b0f5e069760cbb653d63237743", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786415755, "uuid": "3a493449-b7f2-4c0d-88a1-536fa910f376", "comment": "Malware payload", "value": "9d75c4dbbb352b0cc6ea104fc69c3e930f31821f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786415755, "uuid": "7a778213-ec67-43e3-aeb2-e07b713060f4", "comment": "Malware payload", "value": "474c7928f9e769a3c04baa8698ba2eb59f96d3f449b2dbea297566549448eb8b9cd79bdfdaa86edf830a621b5b1b0209", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786415755, "uuid": "36187755-7f78-4383-8e29-4390335c6135", "value": "T199A31A2B348593F0F5411BB077EBA3E37C650BBF146AA09B5B12261966F4B7B603C847", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786415755, "uuid": "1b08c47d-ed05-43b4-9ebf-73ff0bee53f2", "value": "3072:RXxoQPwnMLesu6plyYM26RkttaXK6fheQoU4Uc:wnMtu6plckttaReoc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786415755, "uuid": "4efd4c26-5d6f-4898-81c4-6fae4625f132", "value": 99104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786415755, "uuid": "94615754-611d-4792-b9af-c61783aeb472", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786415755, "uuid": "34300075-2101-4956-ac12-f695f0cd8fa1", "value": "main.openrisc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "141b5b38-9526-11f1-bd95-42010a9c0009", "comment": "Malware payload (Amadey)", "timestamp": 1786412620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786412620, "uuid": "21a66473-dc1e-4d1e-91d7-adb99f537ff8", "comment": "Malware payload (Amadey)", "value": "dcc86d02518b2f23fdfd77ecff71b9e2", "object_relation": "md5", "Tag": [ { "name": "1TEST.file", "colour": "#584C71", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786412620, "uuid": "d67ebccd-b7e8-4ecb-b29c-b155edf1dc49", "comment": "Malware payload (Amadey)", "value": "4911b1593b03a4f312d8314762cd9e3b529fde33f34a61a4f2081f137529ef7c", "object_relation": "sha256", "Tag": [ { "name": "1TEST.file", "colour": "#584C71", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786412620, "uuid": "eb9b716f-c081-49e1-ba80-97696e4f619e", "comment": "Malware payload (Amadey)", "value": "cf72ab43be244d2e89e7ca325e34b9b9dcad367c", "object_relation": "sha1", "Tag": [ { "name": "1TEST.file", "colour": "#584C71", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786412620, "uuid": "e51167c1-94d0-4f10-8372-635e51e589dd", "comment": "Malware payload (Amadey)", "value": "1f6c06df4aad1b9173f0d14e83d4c14e6a5a2daa134a9370b2afc5650fb07fc97d193a509862bd5e84ec630b51bb648e", "object_relation": "sha3-384", "Tag": [ { "name": "1TEST.file", "colour": "#584C71", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786412620, "uuid": "3f6aabc1-4cd5-43af-8082-7a540be57600", "value": "T17AE5B73838FB502DD073FF716EE8799ADD9F7A33660A645A204903478B12E81EE5253D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786412620, "uuid": "81a337ca-d4a7-43d4-9ba8-4e51ae2c36f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786412620, "uuid": "1cad1590-f9b8-4b20-8668-cc38a533e5c1", "value": "49152:Uuh0bWVUbkP2YoWuNVRILXjYdB0Y2/3xQJEFw5nLHEtk:n0bWVUPgLkdBC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786412620, "uuid": "a89d3f37-e3b4-46c3-9c56-b503a89cf06f", "value": 3156480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786412620, "uuid": "d82720f2-b8b2-454e-8c28-6d889d835bb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786412620, "uuid": "d9e18451-fe10-4153-a947-406f1af5215c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85c5f8c4-95c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786480242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786480242, "uuid": "44c50e41-4f96-4242-9e4e-41518e0c39b9", "comment": "Malware payload (Vidar)", "value": "7891bfb34753a34794d00fcbe60958d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786480242, "uuid": "81eca918-8354-4327-9279-1618fe1b84a7", "comment": "Malware payload (Vidar)", "value": "4a836b23c8dcec4d1160d3614581d9650eaaf87d0be2f222d313b164b15d2f9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786480242, "uuid": "75efcd69-92c3-4010-9676-ed9ee37743c2", "comment": "Malware payload (Vidar)", "value": "64b7d2f1c0b2c00a3515414f7e288929b1c58926", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786480242, "uuid": "87741445-a571-4c06-852a-abb7bab0191a", "comment": "Malware payload (Vidar)", "value": "324c22ee1a9665e53a222478822e16e923fbe2e7a5b8a9673d8cc8233fe71a6537fc1e6bc79da648d0bdb286d79958b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786480242, "uuid": "a3424b5e-fdcd-408b-a548-3ef28539806e", "value": "T16B165A037EA548F5C099E73188AB5252B675BC4D8B3133E72E507AB82F763D0AD79B40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786480242, "uuid": "ab717dbb-b86a-4d7f-a9b6-a085f29bb725", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786480242, "uuid": "d8214257-7d14-4ca1-af93-82da7b9bb248", "value": "49152:fYmI9seAc3KMhmgLaSSTTG4YzxRVZLY1m3/yJ1DYNxgv5yu:fs97hmbSD3U16qJVYN2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786480242, "uuid": "8e09bfae-a858-489d-b66b-d7bcb173ce41", "value": 4409712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786480242, "uuid": "f8e149d3-2da1-43d6-9bf5-1b15c9a86211", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786480242, "uuid": "7f1d6acc-3601-40cd-85fe-5a63fd4b60ac", "value": "4a836b23c8dcec4d1160d3614581d9650eaaf87d0be2f222d313b164b15d2f9f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29eb33ec-9569-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786441433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441433, "uuid": "55034c0c-5599-41cf-87bf-cb237de267bf", "comment": "Malware payload (Mirai)", "value": "e2d8d1e67c41ff5e2b3110e8a7bcc83a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441433, "uuid": "c67ca57a-697d-4d02-8324-eae0661fc316", "comment": "Malware payload (Mirai)", "value": "4a8c9a0a8c736d0fcf011d085089fd4bb1f57a527e4a40742b9464d5b38ea741", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441433, "uuid": "0ea2a2be-43d3-415e-92f4-1ae1715aeb30", "comment": "Malware payload (Mirai)", "value": "1a557c4f6c555290373989e4ae961bcede162612", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441433, "uuid": "72b67e07-b741-499b-bf0e-1c40aa4a8cdd", "comment": "Malware payload (Mirai)", "value": "83526e4b745750aadbce31fb98617b82fd33c8b22b3f0894fcb8f29da1a3651d4caaef82e121621ed45a4c7d90e306b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441433, "uuid": "b2c0abcb-dd2c-4b4c-9e87-c2e8bb329571", "value": "T109042945EA414B13C0D627B9F6DF42453333AB9493EB73069528AFB43F8679E4F22A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441433, "uuid": "4fe6a611-ca15-471e-b1a2-358452aa1869", "value": "3072:ODeCv5F8oIw7fGeSaUWzuRJrITjgtmLUe38YhTfYo+M/RQeF1TLn:meCv5dIw7jSaUWzuRJ4tLUe38+x+M/R/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786441433, "uuid": "7872bf4a-45f7-40da-bb50-7fe3a24be0ec", "value": 181450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786441433, "uuid": "940c2bf3-41b0-4a2e-b8e4-227888b680c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441433, "uuid": "179ec466-769a-4d47-b09a-a62fe1a6e6d8", "value": "bot.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c7dfc36-9579-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786448470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448470, "uuid": "7936ba05-e812-4c64-a23a-24ae0695bec5", "comment": "Malware payload (Vidar)", "value": "cb77a1cff4ce60ff321e22070d37e0ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448470, "uuid": "22c10c8a-9ab7-4981-b67a-76dcfecb4b69", "comment": "Malware payload (Vidar)", "value": "4ac139240193b067a98ab7145e3f59c2c44bab20c0a423098b92a6439ad67aa8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448470, "uuid": "357c2354-e7a4-40a8-9066-1f8ce6108f29", "comment": "Malware payload (Vidar)", "value": "284ecde6014a098d2706cb87f9a612560af2a9d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448470, "uuid": "7fb1e3ad-2e66-4840-8444-815e9f61d296", "comment": "Malware payload (Vidar)", "value": "2b0bc7abc6797f195f14bed958b19ea8d41d8a6ac6635982990be13fac713e9251ba06728a4eaaec84c65bf3b5e9249c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448470, "uuid": "8ff86468-b9fb-4ec2-ad49-30413a619984", "value": "T143966C03ED914DA9C0A9A23189B78253BB757C245B3273DB2B90B7382F77BD066B5710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448470, "uuid": "09b8daf1-710a-4724-8988-84d925b2c00e", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448470, "uuid": "8daf0825-a193-409a-8e35-3a48926fd447", "value": "98304:Z3V1x/Rownxk03Kibjs0cDeEAH+SjhvYHKTqH2uVhmdyNoR:Zl1xiSxkuKibjpGb2+SjhvYHKTqH2mf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786448470, "uuid": "1dfc8837-cdde-4723-8d37-973888308ecf", "value": 8673984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786448470, "uuid": "f29d5643-5765-4d63-8a54-dce338694104", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448470, "uuid": "33ff6687-77bb-429b-ab7a-9e51f356b850", "value": "4ac139240193b067a98ab7145e3f59c2c44bab20c0a423098b92a6439ad67aa8.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3ed7d93-9552-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786431893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786431893, "uuid": "89f70e65-c686-47cd-8fcd-0905737330ea", "comment": "Malware payload (Mirai)", "value": "e29849a4b5daa69918d5f6341a965a61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786431893, "uuid": "2973ba8f-fb9b-4590-8dd9-5983243a67a5", "comment": "Malware payload (Mirai)", "value": "4ad0a6adbbf0eb8e13f5a2921c88e72cb7d08fea3644bc689733e91c126eabbb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786431893, "uuid": "3822b7c8-9bc7-4f31-aaa4-f44974fdd10b", "comment": "Malware payload (Mirai)", "value": "fe3c2432920a6df509d5f5d33cfb68bfed027781", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786431893, "uuid": "9d5fb275-6247-4c2a-9ade-bfedaa5ecd59", "comment": "Malware payload (Mirai)", "value": "aa724c075da126b463ff217f4b4a9eddc9ecb88619d5223f7de97495906bd7c124c3aadc1263b4ef13f4356e91193e6d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786431893, "uuid": "43a0e4ec-711c-4ef8-bcd3-9de7fe25341d", "value": "T1C5A32859B881AB15D5C526BEFE1E428D33135BBCE3EE7212DE105B2167CB91B0F3A502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786431893, "uuid": "6db963fd-0f46-49ef-8e84-5dafe9c1c9ac", "value": "3072:NGgSZjWvwk7e4fZsUQFJvLGaDwQeuLjj+ferQfvfz:IgGavwk7eCZZQFJGaDwQeuHj+EQ3fz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786431893, "uuid": "f3401f2c-fb34-4a47-b673-516a0ba827dd", "value": 103624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786431893, "uuid": "e717b59e-3f07-401c-8cb7-478008fd7348", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786431893, "uuid": "f1219c2d-8f65-4a9c-b2d7-c296c98c7030", "value": "lul.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e70837ab-95bf-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786478687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786478687, "uuid": "a1427418-d391-4d62-8162-03c99b820743", "comment": "Malware payload", "value": "9daeaa6fe3bd9bbe9ef959fe94db44ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786478687, "uuid": "e2490927-eeca-4aef-bc90-ac233e01847c", "comment": "Malware payload", "value": "4aefd037c8643f960012101b21d2d016f745bb77c7b426156cbe9c0d3b395f5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786478687, "uuid": "14291e58-d3af-4841-97f7-5e304e885d4b", "comment": "Malware payload", "value": "92422b49978908567447c2f69aff4bc52966729b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786478687, "uuid": "ed51b133-a61a-4d9a-abc0-52338c97dc50", "comment": "Malware payload", "value": "6dc01cff2fd1a937be41ad26b7df8e3c65f897dfead02714cae81eba9b5045640df449edffedae1c121d9d904f652893", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786478687, "uuid": "4bd416b6-13ba-4146-ad42-40b60057ed44", "value": "T1E9366A03EEA548F9D296D73588774242B764BC499B3533D32E60BA742F363D0AE79B40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786478687, "uuid": "488c8578-b75d-4fdb-b31e-b4c9e2e15c57", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786478687, "uuid": "f6968f8e-1ff1-4065-83c8-0d2ba6dac21d", "value": "49152:uFKpz7i7FAlc03DCBGcm+a1h6TczyJPj4RRHrYvAaaH:uc3XND1aJrCOkH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786478687, "uuid": "99df941c-b2db-4aec-9423-3226efb88086", "value": 5001185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786478687, "uuid": "741b0fe7-5876-4307-8840-41ef52ff04a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786478687, "uuid": "cc3ccacf-9818-4570-88f6-6d735b0b203f", "value": "4aefd037c8643f960012101b21d2d016f745bb77c7b426156cbe9c0d3b395f5f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be93f1e0-9550-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786430945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786430945, "uuid": "4afafbb8-f1dc-437d-bf56-4583fbe53b34", "comment": "Malware payload (Vidar)", "value": "1ee36fe4ffa29be8504b9d0f7d3e47f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786430945, "uuid": "29253f91-8f8e-4cb0-8d3a-a3081035ff47", "comment": "Malware payload (Vidar)", "value": "4af3cc00227c2a94b034b6297ec4ecb0c7ff145ba5ba2703692e99001290bb2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786430945, "uuid": "0afe9801-61c7-41e3-b200-7b74b78c2d57", "comment": "Malware payload (Vidar)", "value": "27c68f35587e6ad0d8852b1078dee08c7c99aaf4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786430945, "uuid": "41c7b273-9595-40ea-8151-e12a00fe2171", "comment": "Malware payload (Vidar)", "value": "7c5d54097c11b0568a11170f508cb1f52cd7ccf01ee6e110c52a5fb546380956263968499040db54caba1119548a92d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786430945, "uuid": "eaec8b21-05c6-45ab-b104-1d03c68eb2e0", "value": "T1706422C56124219FD99128B0CB0645937E9C75837CBAD6A2A3DFF2C4E99C7C93E0162F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786430945, "uuid": "e4888813-209e-4ca5-9c6b-88cce6801b1a", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786430945, "uuid": "ee1a62c2-810c-4067-ae94-66302d756104", "value": "6144:a/nyRFP6OUs9LNkewS6D1zqfD4DSXG8PF56XmljojWq1OZNwp+0:a8FiOxFcDcr4V8PF7lsjEbwp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786430945, "uuid": "d7e03459-721c-49e8-8ed8-e718dfee9e2e", "value": 311808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786430945, "uuid": "eecce673-9d56-49af-938a-0f812944c649", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786430945, "uuid": "06bde745-d2c1-4f15-bada-a145e16b7bd8", "value": "1ee36fe4ffa29be8504b9d0f7d3e47f0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72181390-952a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786414496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786414496, "uuid": "5636217f-219a-47b2-b349-0403a2b081c7", "comment": "Malware payload", "value": "66566fc51d00b868aafcb4a4ed372368", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786414496, "uuid": "ed0c1a43-c261-47af-a02a-d62ac88d76d5", "comment": "Malware payload", "value": "4c5a6b87212177f62fe3174916727a424223a1a315cba018ea5494f3c2e1dffb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786414496, "uuid": "d351d9e3-4517-4903-8efb-d6a46bef8e94", "comment": "Malware payload", "value": "a63d1b4e6deda0b04000428447fff9327ef1e8bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786414496, "uuid": "9eb191b1-12b9-4e3a-aae8-6fb3152bae73", "comment": "Malware payload", "value": "502e67ac31d74cee0a5c5a62390340858c696b92c1369c100ca4a28c0489a00560bb12eb207786675b0050aaf86b1eb5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786414496, "uuid": "59df8cdc-051a-41db-a67f-9df855b62f51", "value": "T115636DA9EE0E7941E2C9E375EB550BE1B12F38A0D36644F73902718DC4EDADD8ED2205", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786414496, "uuid": "3928f4a9-12ac-4d97-9646-6933556e0830", "value": "1536:7Nec8lKegBn8wGH/AeyuqHobrhrKi1Z/NnQgL9MPcr:LVx8BH/RyuqHeh/ZQgL9MP0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786414496, "uuid": "757db46c-9e36-4abf-8a2a-6ce285db78e4", "value": 70720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786414496, "uuid": "f0fbb4d6-c000-486f-bbc2-6315ef2a0db0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786414496, "uuid": "74206df4-4e93-4f02-bbb9-3ef4af0892f1", "value": "main.aarch64be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ab1524f-9569-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786441434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441434, "uuid": "a83e9d2a-200c-447c-b56b-d751076ee7f7", "comment": "Malware payload", "value": "300d266988ee922d6c84269efa789bc5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441434, "uuid": "4ff9632f-8ca1-47cc-bb32-319becef6e39", "comment": "Malware payload", "value": "4c76fdf42cbedadf969e6e8e6831962dbbebe7ad6fcc7fb35178274ec6108e55", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441434, "uuid": "136e7438-c3d5-4281-a725-1a7c118d0162", "comment": "Malware payload", "value": "6876edeace7a17d99cc282b9ee91695550f21743", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441434, "uuid": "0dfe341c-ae70-454e-87da-182c0b932fab", "comment": "Malware payload", "value": "88aed23e5d87649d2694263f49fcf24857d554b83221b1ee6c85df81a8612a260483f22a8760b839c39fe2ae6d0b2a42", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441434, "uuid": "30a97037-87bf-4d7a-bfe4-aa29b9f80d98", "value": "T11F620906FA419F12D4E120BFFFAF421833432F64D3E6721286209F64274A9DA0F7A916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441434, "uuid": "0d68f24b-345a-4965-857d-7eba15e39b91", "value": "192:VKcPnWQAsji/PputHJoXR2qQlpgmEZx4egwc8RQa5DHYiePIOFrx0RutStXIZdUP:o4nWwjiJuvpgXx4egwJRn5yQIelhz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786441434, "uuid": "60da3ed0-ad2f-46b3-8a87-937b2617d78e", "value": 15900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786441434, "uuid": "4fdd74c3-737a-44e2-84bc-3899fa15eeca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441434, "uuid": "df750ce3-5a85-45a4-b92c-55b04c3a06bf", "value": "dlr.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db242ef3-952a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786414672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786414672, "uuid": "d74c9d94-db3b-4758-ade8-ea7d2d59756c", "comment": "Malware payload", "value": "e26a7989eea6c7910c51cdba424933e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786414672, "uuid": "f47d8bb3-5eac-4bf3-bce5-3bd12f684f35", "comment": "Malware payload", "value": "4c946609323494ac329f2c4347d103595a1d0cebe99bdc39acbe19b3a1562178", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786414672, "uuid": "7e0e8f20-749d-41fe-b6b4-354020247ad6", "comment": "Malware payload", "value": "9c59589c6fb83684f98693a26e6df4640f3e0d6a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786414672, "uuid": "7e2b68ed-33cc-4b73-970f-990f6f150953", "comment": "Malware payload", "value": "35ab20e4eb301daae4f566941812b81d716af89f93ac9a44bb70d655035109ed58359ff351740f27de2ff19341f76406", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786414672, "uuid": "97690a9b-e833-4fd4-8089-f4e95ff000ff", "value": "T1CAD3E70333487A95DF47A83F9687BE117392B99413518562BB10120FAF76B7ACF0EB49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786414672, "uuid": "35447fb7-c7c7-478a-974e-22e43fd39964", "value": "1536:2fB+n4/jxjiJaGwk23p10Z//uNcbMwMmpHk1gN5ozPmPobSUrm7bh:/5JBwk23p1+//PXMmp0M54uPobH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786414672, "uuid": "2479ace6-7fd8-465e-b8fa-b38829946195", "value": 132248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786414672, "uuid": "846491a7-7e2e-404c-9384-76fa487df257", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786414672, "uuid": "4807dd92-ca01-432f-a4a6-f74a9efaf0fc", "value": "main.power8le", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e266534-955a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786435185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786435185, "uuid": "8d60473b-0f31-4e8a-abf5-52942b8030f8", "comment": "Malware payload", "value": "2e62a6d1fb1e7f3f6240c52fd3739bd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786435185, "uuid": "4f69cb95-44a8-4c58-90cc-335e40eb3e94", "comment": "Malware payload", "value": "4ca0c5add1a50bcddbc24eef272ae0c0feaf2fe07091613d3fde149ba255d40d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786435185, "uuid": "1efd975f-668b-414c-9cd9-4e1ef147fddb", "comment": "Malware payload", "value": "74dfcec233c3c9b138d17f837237aeb8776af4d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786435185, "uuid": "ef96f177-578d-4739-be3c-74d80780de69", "comment": "Malware payload", "value": "06520eae01115346b8f0bca690a4ed947c593e91abc9b13e9f2deb6bd79e2bd7b96071b02be805612068b52372ec88d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786435185, "uuid": "540356b6-7c9a-402c-91f7-358aa09aa13e", "value": "T17AD5239ABCB329B0D437C7B69D93F06D716A77958B308C8B39CD98104D225985C70BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786435185, "uuid": "e96d23a6-264a-45ac-8e16-3640ddcbbfe9", "value": "44140cbbe125df54636c585913f74c75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786435185, "uuid": "e4915a0f-7dd8-4b27-b718-acea9f48f885", "value": "49152:1Tvi7iBP6pIUur0oBOFyR/FmoDP0F8ibmcK5cjjJ5xAPDXVyl+l7vvGSwcO:CDxur0YmI/FnPiI5cREY63GSwb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786435185, "uuid": "7cdcc5f7-969c-4f83-a25b-10d8cda701b3", "value": 2988032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786435185, "uuid": "fb753ad1-089c-4920-ad52-dfd52ca0e429", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786435185, "uuid": "c365cd46-6978-4702-84de-b5b85884995c", "value": "6eq5gvOfRvNmCi54.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5805bc10-9592-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786459119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786459119, "uuid": "980ccc01-06ca-4fff-ac24-5a9fe203bc79", "comment": "Malware payload (Mirai)", "value": "7b7182e029f2ef0b661fc726efa93a3b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786459119, "uuid": "77a93751-8359-4884-bb95-9085fe3efb38", "comment": "Malware payload (Mirai)", "value": "4cc0a410e3f902d6798920a5b92b41465bfe4c1a5c234cae3ef21e89afb7642c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786459119, "uuid": "d0932f39-c0e7-4acf-bf80-0c92b4ccde59", "comment": "Malware payload (Mirai)", "value": "362fa0cf6ac2da2e6f98d35fd1e4a0a2ef711377", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786459119, "uuid": "08e17a13-091a-42c1-8f54-5651093c39cc", "comment": "Malware payload (Mirai)", "value": "701b3176c9228cf18f33fe77bb28e98f2b19f9858d5b4123c9e2f279bf5f2189b26b4b60a0ff8ee3b40403f18238bc42", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786459119, "uuid": "ba78361e-28d5-46b4-a0b4-3f3593a62a98", "value": "T1AE43F1E2BC777BD3CC0F123BA81A240B27056B6AF245D8B5289CB4371D45E47647C5EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786459119, "uuid": "6cbfad95-0285-4ce2-8de0-c6c9d3d0edae", "value": "1536:e3GB0YGqsisuKToh1s8WybvuYQmnouy8Gy6:9BsBuY9WmYBoutu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786459119, "uuid": "c6ab6c38-3a40-4558-83ca-e53c419ef37e", "value": 57772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786459119, "uuid": "ad57f489-a368-435c-b4d6-ed66a22fea6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786459119, "uuid": "0cee43fd-1879-4e2b-b90b-09b9b067cba1", "value": "sdfjgnjsdf.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29dd429b-95a7-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1786468061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786468061, "uuid": "4bcad9b4-51b8-4e22-b3ea-77b6f25e0521", "comment": "Malware payload (SalatStealer)", "value": "186bb6e4638c83d7bdf21c1e3dcd8fa9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786468061, "uuid": "8977accb-ed3d-4466-b6dc-a42e2a1296cf", "comment": "Malware payload (SalatStealer)", "value": "4cdeb961e4610ae297df14362f280965cd4e646e595d63a2d3f6e9b4240e1459", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786468061, "uuid": "aec032c7-6c9c-46ac-a793-9e13c5c27812", "comment": "Malware payload (SalatStealer)", "value": "dc2c226fdadcc420c148e8f9830c6b3ca954e5c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786468061, "uuid": "268eb370-fddd-4316-8882-cde39724f55c", "comment": "Malware payload (SalatStealer)", "value": "ee219d07d10d2f0b2c84616c50e4ce1d15ed7aeeb6201f79244714481901ebf61183871a2fe5f0ab6d191f81dc7da8f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786468061, "uuid": "0f0ae6a9-9d2d-417d-b539-d3817912ac48", "value": "T1E3C65B11FADB95F2E9035831016BB37F23315D048B28CB9BEB547B2AF87B6A11D66305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786468061, "uuid": "8555eb3a-c28e-49a1-904f-a374c67e3499", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786468061, "uuid": "d0804d5a-f386-4495-b15a-3acc1d1e4bbc", "value": "98304:Pun+uBu7zmCvjkqwntcKNEAr4tG20CzEc0:FuK/jl4cKW0Ht1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786468061, "uuid": "7f84c000-e435-4f42-8aa6-1a8c16946c0d", "value": 12572160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786468061, "uuid": "5007dd90-658a-4bdc-ba40-4b042145ee00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786468061, "uuid": "cd1aad1c-358a-4d7b-bef6-8b72e08533e6", "value": "Zapret.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e23f1b73-954c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786429287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786429287, "uuid": "f3029102-df13-43ed-a006-11d8accce0f1", "comment": "Malware payload", "value": "35b03870482100d2c5b500ec82b4a6c3", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "SHAPARAK", "colour": "#125FCB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786429287, "uuid": "d76711cc-334d-4141-ba00-7bcbef71e750", "comment": "Malware payload", "value": "4d0f7a96a4859f47820ffa8e08b89ff7c7159fa3414a1cfe88db4949d65e48a4", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "SHAPARAK", "colour": "#125FCB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786429287, "uuid": "0f12423b-d36f-4403-aa5d-fa382a5dcb1d", "comment": "Malware payload", "value": "8a3d22aa172b7244cc77db6d747a710219fda4d1", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "SHAPARAK", "colour": "#125FCB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786429287, "uuid": "10fd66d8-4ff7-42f1-87d2-d3bd6a34eb9c", "comment": "Malware payload", "value": "22318b3c839901c312a859210215319d242fd35450dcacc85152157a622ed9f24d20f6033905fcbcc6ad8fc1f3f08f2b", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "SHAPARAK", "colour": "#125FCB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786429287, "uuid": "db126550-c1b1-42ff-ae74-d7d8e3d42394", "value": "T14EE523A2F345153BC9B78A329AD75BA0131A8E4089D67B0F6158362C6D733DF1F69EC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786429287, "uuid": "6c3629b6-6c7c-48f2-babb-ed620efa5471", "value": "98304:mpz/poD2J0wJs8vaRvVUk7D6mq7sY7XdWwcpUdyI:6oDUTO8v02k7D6mqYAceyI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786429287, "uuid": "07796962-9c32-4a05-9f01-c68e9a7a4302", "value": 3261089, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786429287, "uuid": "e2a4c4a6-e624-4723-ad66-066795ab1bcd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786429287, "uuid": "4f3cfb66-01b3-43f3-8995-945a9b539d37", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed0d1851-958e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786457652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457652, "uuid": "ba8a1af3-6596-4727-b11d-f368eec3a8cd", "comment": "Malware payload (Vidar)", "value": "7cd958b0ee469480d5c544c08120191d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457652, "uuid": "3d0ce39c-cba2-4647-9a1c-6ce3f3d00795", "comment": "Malware payload (Vidar)", "value": "4e0b860584a925ff5d70e413ee5bc7e8126fb6fcb73988325b6be8f63f4c2d10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457652, "uuid": "b99afe0e-1227-460a-b7b5-54b63121b6db", "comment": "Malware payload (Vidar)", "value": "84f127e33d70553c1f3c2060245602b46ac0cb4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457652, "uuid": "2689d25c-e57d-4044-b12b-2650162939cb", "comment": "Malware payload (Vidar)", "value": "693c0babfd6f36202d17f2f33dafb8a342343fea5a4b92dfab72086e29d8a4a5970998fe633235f91ca9807bb16c5946", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457652, "uuid": "99204f58-e823-4a30-ae52-62532bf8c907", "value": "T128F58E477DA149F5C0A5A33188775251B775BC498B3533EB2EA0BAB82F323D09E76B40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457652, "uuid": "2fbd5f00-9460-45d6-8ee2-c6870852c920", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457652, "uuid": "e57acd20-5521-43ac-87cb-5e77a612374f", "value": "49152:UQoxHf9Wbbh5rUgYRoZ9rNGcxEvRGI9L8HzF7egAYcsci9CS4kFwU:Uj8YyrdEvUIeHzF7rAYcsci9CHpU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786457652, "uuid": "038932e9-8c50-4778-b308-e96e8b25aad4", "value": 3531128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786457652, "uuid": "5dc6f852-d807-4ef8-a101-f1204821c2c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457652, "uuid": "e70716d8-4e92-4d08-ae60-3c6f38af110c", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb3fdaea-95ac-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1786470533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786470533, "uuid": "cf00ac25-3554-4942-96a5-62d4399853a6", "comment": "Malware payload (RemusStealer)", "value": "4a3efaf4fbf4f8f822d646ab6528c712", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786470533, "uuid": "7950d03b-eb0e-4207-b155-860609354a93", "comment": "Malware payload (RemusStealer)", "value": "4e0fed3312ba60dbda143b9551048a321cac2e202e20a55cd81177c1e1e99893", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786470533, "uuid": "324df2bf-c726-4017-807f-162e0c795469", "comment": "Malware payload (RemusStealer)", "value": "be9b0346020324fda76891af4ea77ba1cf037048", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786470533, "uuid": "0fa3be2e-fa34-418e-acca-ce3a291eb152", "comment": "Malware payload (RemusStealer)", "value": "c2c846b1344d637c8772f5cd3c9c05bf4baba0e611821c9094138cb937101c28e06883d08016ebd021033a86844dad61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786470533, "uuid": "7c524c29-3b48-4999-b36f-8b59a2afb1b6", "value": "T185063907AE9148F6C099E735C8775252BAA0BC4C4B3123D32EA0BAB52F737D16D39B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786470533, "uuid": "633fee68-86fa-4e61-b538-59ec2eb49c92", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786470533, "uuid": "6227c053-de1d-4414-a700-19c770f36992", "value": "49152:hXs4p9TK2PE7ea8cV3mz5j1wi+RKhr2MEI8wRIA5NlvTkWXw1:hN8ngpIqI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786470533, "uuid": "d0a9c440-cfd4-4e6a-aa76-74e510b57f57", "value": 3730816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786470533, "uuid": "b824f07e-91d1-4751-98f8-bff4daba7fa5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786470533, "uuid": "2f568523-b2cd-4512-953a-d010fc8cf436", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f37b611-959e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786464232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786464232, "uuid": "73a8087a-6395-4d26-9879-f25681ef4da4", "comment": "Malware payload (Mirai)", "value": "6387aed99ff2814e74a6e1e153f20e71", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786464232, "uuid": "0a123a6a-3aaa-40a2-af19-363740d080e9", "comment": "Malware payload (Mirai)", "value": "4e4d0871610d78af5a83f953922d678d75f5ca1b3e2720d4603231e3ed74349f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786464232, "uuid": "ff627b7d-8835-4e0b-bdec-ae5033541073", "comment": "Malware payload (Mirai)", "value": "255137aa6cc5e024f7b261a1885bcb6edcae61e2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786464232, "uuid": "0f6ba507-9748-4249-9ab5-d67767bd20fa", "comment": "Malware payload (Mirai)", "value": "25e1bb623677840c853654c18358e54dcdf6098fb8c7416ab9e87106c653f00ddbf3dac91bfa00d12b5d0c80f03b6f24", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786464232, "uuid": "d4c11493-c485-47a8-9f95-1b24b5e0e449", "value": "T1A5964B37B6A285DCC08BE1746A9FD5F3F920B4F40221206B27965A367F36E900F6D791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786464232, "uuid": "24c8ebf1-5502-4815-91ec-392321d8b0fd", "value": "196608:VNlusYpHZPaU8ZlgoHOdWPV8ZUah/KrUb+Hs:VNlu/xaU299ah/KrR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786464232, "uuid": "42bdd530-904e-4815-bd3b-9dc57a10260e", "value": 9438895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786464232, "uuid": "000414ae-bf13-48a4-8d3a-c83771aa3bb1", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786464232, "uuid": "d580a1fb-d9d9-484f-b791-68f871c2e355", "value": "wd1337", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cda9f49-9599-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786462054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786462054, "uuid": "b53dfd80-8633-42a8-84e2-67c354c9e731", "comment": "Malware payload (Mirai)", "value": "7f2007d90dc1b5a143e99ce86b97c06a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786462054, "uuid": "762078f9-baf4-4964-bec8-4c021ae2d441", "comment": "Malware payload (Mirai)", "value": "4e9729db217b0a9ee61a51c05ff32840503cf6bc86617220352f2f32cfa2aa79", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786462054, "uuid": "843f467a-7e33-4d3e-abe9-bb91702d6cd4", "comment": "Malware payload (Mirai)", "value": "7d6927e1c590c148e6b67479ef2b8cb17252b21f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786462054, "uuid": "432d3cf0-fe04-438d-80d0-f58e75e38595", "comment": "Malware payload (Mirai)", "value": "5e943a4edfb3e99e308afd0d1c0f8fa1c6dee60864f5346054e262554ab070dfc5985173341b624e3288b38b2500cc78", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786462054, "uuid": "b137b1f1-76e8-40cb-a924-0b9b5a671516", "value": "T17B7302D1C3795069F93524B2E9E116D957916FECC3FB44F30BB0D814BA2624F39C5909", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786462054, "uuid": "baa8cee6-111c-482c-bc71-04d62fb4fce5", "value": "1536:hjUVeJNgcCuGoS4GS+d8YTGN26viIEy9YRIOlDsLAcDX6xcERsHU:pUVO5ioS8RYaN5viFI0DsLLDX6xcas0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786462054, "uuid": "9ce18ac4-72d5-4789-8ce1-e6d27dd66dee", "value": 73720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786462054, "uuid": "6cbadfc8-c250-4782-be20-1b66042e782a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786462054, "uuid": "654e5d9f-5009-4ec2-9249-8a114e902997", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fd5c159-95df-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786492150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786492150, "uuid": "abd1f98d-3f54-408f-8ea5-34ad6f32e587", "comment": "Malware payload", "value": "8c2a31e19b6f4d3077757f38e0a12706", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786492150, "uuid": "da699ef0-cfe5-4164-81cf-2d7977a5162d", "comment": "Malware payload", "value": "4edf0f15b4bc5919472a932858d8c1d21540b28e0dfc2e560227b4b52a303908", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786492150, "uuid": "40d1e0ed-7821-4cbb-8e0c-12a41b55606c", "comment": "Malware payload", "value": "73963b9229292950abdb981dd7968a3db48a3eb3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786492150, "uuid": "3cb6e9d3-364e-42d0-9074-05d5703f51cb", "comment": "Malware payload", "value": "470a07c386b4ec5c400f5d089cdd42687d935d5f8c2a9f86cdc8b0ee49f4e3743adbeb96857cd11fb1940b5e4ac67b3d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786492150, "uuid": "98e3a497-91b1-4ce0-8806-f2582c47c2f1", "value": "T124C312E166BB9A7DC89712F124C776458C02B569B9CDF33FEC58307B9CA2D180D386A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786492150, "uuid": "cdc98c39-5403-447e-b1c9-68c9af2cc03d", "value": "3072:Y/Dyy7oZVZzuFRDXiObFLSfLEeHZE4lmRWo4w9jnKoutl:YueoJzu3biO0fLEe5EOmRWoTGoSl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786492150, "uuid": "6132b663-ab6c-479e-a4ea-3830529f43f5", "value": 120980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786492150, "uuid": "d2a1f49b-a7b2-40a5-a1c6-af3cbda47b22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786492150, "uuid": "af32c5d4-ced9-499e-949f-f8ab8283050f", "value": "4edf0f15b4bc5919472a932858d8c1d21540b28e0dfc2e560227b4b52a303908.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "414bef09-95d0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786485710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786485710, "uuid": "e4a8dd6f-5d80-45aa-af08-73eef3a088db", "comment": "Malware payload (Vidar)", "value": "87dc61efbd37b1ca24d558ffd23ce044", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786485710, "uuid": "3cc8af9e-cb6b-496e-9b93-b169d0640ece", "comment": "Malware payload (Vidar)", "value": "4f4bd485e8615f45401e0ba17c9f6543f185dea4df144a833c4cbdd17696903e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786485710, "uuid": "3e1fb9c7-f0aa-4a60-a9ec-9ebdc919e1a3", "comment": "Malware payload (Vidar)", "value": "d4eb3d50b6dc0f3ae814842ce8d2cb905c09de94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786485710, "uuid": "14e42ddd-ec87-4967-8d2d-5e3df30f9f12", "comment": "Malware payload (Vidar)", "value": "7a03445e82afd613280f755e1d2c15a80d482f9df7ab1af6d2c9e51c661820db4e827032c76466ac6b38bd9503a465d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786485710, "uuid": "e73e6463-2d22-4de7-9b95-8eea0802dfbb", "value": "T10226AD47BD915971C099AB3188B602527B39BC0E8B3637E72EA1A6357F337E14D35B08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786485710, "uuid": "d28e0ee8-4d7f-41f6-a553-69d5bd2c403d", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786485710, "uuid": "4ca2d0e0-3ed4-41c1-84b1-a016e2e24920", "value": "49152:qKqKqW/y8vbodhjJrqjkbqbDXLnQfnmsdPtZDRAPiZDY/HtEGK8b:qKWPskSXLQvmsnZtAam/H6T8b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786485710, "uuid": "2262bb1f-6f9c-4018-abf2-4f5cccfae728", "value": 4459576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786485710, "uuid": "c82d93ba-8c0d-40b2-bd33-3f30b7e62b17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786485710, "uuid": "e76d553f-8239-4641-b5c4-4184a63d0351", "value": "4f4bd485e8615f45401e0ba17c9f6543f185dea4df144a833c4cbdd17696903e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed55a052-9557-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786434030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786434030, "uuid": "297f46cc-3a1b-4b8e-9ec1-38799763b60d", "comment": "Malware payload (Mirai)", "value": "1c851ab8e0b4761325534393b87b0c5b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786434030, "uuid": "fa223668-7273-4c96-8528-1c612b161843", "comment": "Malware payload (Mirai)", "value": "4f705ad781aa77ee8fc380faf902ae19a6368d0fcdee76904619e2b2c2f1ef46", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786434030, "uuid": "ed9a46a5-b4b3-4bd4-9e0b-53cb56828940", "comment": "Malware payload (Mirai)", "value": "f2c2bfe83fcbc243d85e9b9aab8914015d678d25", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786434030, "uuid": "36d70673-ad18-4eb6-bb11-05bd24632aab", "comment": "Malware payload (Mirai)", "value": "cd6ad6c4402adc169de011c909948b6352aa64d0cc2fe56221ea1739af96fe0aa96b4731807c3aca88e3bcf1f46948ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786434030, "uuid": "d0f37425-7da0-4578-a0b6-53568a7646b6", "value": "T1D8157C99E7C6E0E1F66300F1035EDBF65534A12A4013FAF6EF492663B4327A16F1621E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786434030, "uuid": "0e8408fd-b109-46b8-b9d1-e8b00df4108b", "value": "24576:KcegNL8h3JhBuPYboMQJIXwoi/632Ineal:ch3JhBukoMxMtIN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786434030, "uuid": "f4d0452a-f8c1-4f82-8bc4-6f17be1a3ed8", "value": 939896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786434030, "uuid": "7de350ba-eb9e-4b4f-862d-3d058d3450f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786434030, "uuid": "08600a86-80b0-4d43-b530-f620112f7400", "value": "data_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9059e8e-95d8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786489347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786489347, "uuid": "27ee4a46-78b4-4a61-ae57-a163855a9b91", "comment": "Malware payload (Vidar)", "value": "9b0e975ae0f6534fc0bf24750d76d03e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786489347, "uuid": "b4b04b15-a693-4a6e-aa81-d655051c0180", "comment": "Malware payload (Vidar)", "value": "4f70893eca36159a101aa8c151f545f937d952bc1c9bc31a37722b5e4f6dc860", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786489347, "uuid": "6e994e90-bdc4-4d2f-b236-e0b58f3484bc", "comment": "Malware payload (Vidar)", "value": "1965542716a97067e7c78ba3520c8104210c483b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786489347, "uuid": "12ba2ccb-608c-4e70-804b-148d78fc6181", "comment": "Malware payload (Vidar)", "value": "20577b238ff9df23c3843e1164db057279fcfa65a662e3b95c26de39bbe4315dbff73f536e9c8e6ac624e12fe0f7d1a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786489347, "uuid": "bd9aedfe-89ba-4c3a-bc07-b162bd1e668c", "value": "T19F265907BEA548E9C199D735C8AB42127B74BC4C4B3133E72E50AA782F763D09E79B44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786489347, "uuid": "ebe6b0c9-dca7-4b4a-9e3b-25d4c5cf2d98", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786489347, "uuid": "e4480632-fc44-4a1d-bb7f-93795496b228", "value": "49152:LoXrCRdCMq+yugtH+raYJ6UPZKHF/aIZ2I47apVqsmkyMDfDoT4bkTU3MTcjU:L9X5agZ0jVqBkyMDrrkwU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786489347, "uuid": "1b7ad4b4-f0c9-4e7c-8ff3-831a377c9d5e", "value": 4857696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786489347, "uuid": "8036d2ec-cbf6-4593-822f-12e0e2bad399", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786489347, "uuid": "ea415fc5-e5dd-4183-acf2-8fc3b56002e9", "value": "4f70893eca36159a101aa8c151f545f937d952bc1c9bc31a37722b5e4f6dc860.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e79ce869-95bc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786477399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477399, "uuid": "201723ec-edee-4a2c-a3d2-cb983bd68a8d", "comment": "Malware payload", "value": "a8062b5d64c1d66882aca91fee901843", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477399, "uuid": "53696019-0340-4872-a163-786a252b4a65", "comment": "Malware payload", "value": "4fabcc81d9f831d477fdf04967b21de142af4184e3d156f5c081bbd27c62099b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477399, "uuid": "fc0a9686-ef0f-42d2-8705-8a4360539d80", "comment": "Malware payload", "value": "03a0946bf0c3068de90d8bdea33ca72a854be0aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477399, "uuid": "5ffaa936-03c9-4f64-b905-624f99b1e693", "comment": "Malware payload", "value": "0b34293ad4a2eff23cc778d208f1e49caa9f80e591b29f8d22dbb2a5e47195cd9d871ade7262b8c727fa81a0c226858e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786477399, "uuid": "a4b52ba2-5502-4acd-9943-3d3ed72fec3f", "value": "T15B366B03EEA548F9D296D73588774242B764BC499B3533D32E60BA742F363D0AE79B40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786477399, "uuid": "de98a8e7-c328-41b8-acd7-ea6cbbb16d21", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786477399, "uuid": "c2ad7162-8559-4479-8faa-1df7e9adedd5", "value": "49152:uFKpz7i7FAlc03DCBGcm+a1h6TczyJPj4RRHrYvAaa+:uc3XND1aJrCOk+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786477399, "uuid": "920d507d-0517-4f0d-b4fc-2fbca71d043a", "value": 5002585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786477399, "uuid": "453b79b4-575c-46bd-b286-761335e8867b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786477399, "uuid": "0448b9e1-2449-4fad-b777-da37fce22691", "value": "4fabcc81d9f831d477fdf04967b21de142af4184e3d156f5c081bbd27c62099b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2501a1f-955f-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786437367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786437367, "uuid": "9d5c70bf-8421-4fee-a0be-3e02ae942e00", "comment": "Malware payload (AgentTesla)", "value": "dbcff0beaec0ad19c11a28a2f1c50a96", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786437367, "uuid": "649917c2-5177-4f28-8055-bd8e04643d50", "comment": "Malware payload (AgentTesla)", "value": "4fc06941e07dbff9fe5756f2803fe0075f29a7eca3969db7947b4d33d8ff6601", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786437367, "uuid": "c751a774-d376-407a-8ab8-06fcfc1c27cf", "comment": "Malware payload (AgentTesla)", "value": "49e6375f4d3f0c86658f19937a529bbda5cdc828", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786437367, "uuid": "b4189eb5-3b53-4ac8-b9ed-975ad993417d", "comment": "Malware payload (AgentTesla)", "value": "afc711afdfd9a8fb94588986274f5ae8f90b9af727c441ccbf644556023f9c1133e575aaa864d850db4fc02814afbbb9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786437367, "uuid": "ec96aee4-8eb8-4596-ac9a-0cad4f9f8928", "value": "T11CD4232E2413922FE5E136696D2D0C7D466DA0D2C2F1745CBACACA9714F13879B133AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786437367, "uuid": "c23ff99f-bdd9-4f8b-8216-6920f3ddbc4f", "value": "12288:AwZvPYLSnYCby1bJ4ao7xh+wc28JlgQL9GZ:/BPszCbSbJ4/dh+p5TgQB+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786437367, "uuid": "1d9e4685-9bdc-4a89-8481-25a11f7f4e23", "value": 651139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786437367, "uuid": "8e5b54d8-d834-4e82-bdd6-458a97109b09", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786437367, "uuid": "845bf7e9-b4f3-4445-889c-a18709ddeb29", "value": "Purchase_Order_PO111_125895.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fee99cfe-9569-11f1-bd95-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1786441790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441790, "uuid": "2e98b600-ba91-44d2-aea4-716cdf89071f", "comment": "Malware payload (Gafgyt)", "value": "bec544ce9efe70b1642e2c10a27cae96", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441790, "uuid": "e8c8a24b-4f3c-40b1-a54a-79410681342e", "comment": "Malware payload (Gafgyt)", "value": "4fc97f256de9e479b9befc4de3afa6a9236672605f3215e37869ae173fb6b281", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441790, "uuid": "96cd5ad4-0bed-4107-9f38-daf8e2f8e411", "comment": "Malware payload (Gafgyt)", "value": "3371f771ef0c25121efda976563ef304e8a4a85b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441790, "uuid": "53881d60-58ad-4251-a221-efc2923865ad", "comment": "Malware payload (Gafgyt)", "value": "f1d75f40b5ffbc6f75677548484533fe6f5d3335e26c29f3ddf76253b33efdc7b748852bcd437f9c25112b2cd51a143b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441790, "uuid": "250fe059-126b-4ad8-afe5-4a4871049c38", "value": "T1F3B31893F501EF67F80EE67604D34B24B670BBA10F932662731739AA9E761D42823F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441790, "uuid": "074dc68f-240b-4320-8a80-37479d923c87", "value": "3072:eejkqb936yFRuWz2wnuAHyTmiK0PDrZlfkKo:eNYqyFAWz2wNwmiK0PDrZlfkKo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786441790, "uuid": "dc29a9a7-0b76-470c-ba0c-9afa4efe5317", "value": 116925, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786441790, "uuid": "5bf3184f-f6ec-40b6-a2f4-4197d400f55b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441790, "uuid": "5e8dc8dd-f942-4dc1-b1c3-2831acebf609", "value": "i-5.8-6.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a99419a-95df-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786492222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786492222, "uuid": "b6d05462-2f20-40b6-8444-7072324d5fe2", "comment": "Malware payload", "value": "ab46ae98b74f67f0a307d67020356f2a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786492222, "uuid": "cad37814-b177-41cd-a49d-087232b6fa0e", "comment": "Malware payload", "value": "4ff6f898f11e8ea6f600227add4bb657bb3b10456b0fd636cf25933ae77d5c34", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786492222, "uuid": "ec81e61b-b6de-4f72-bdcc-e0aa00f63fc3", "comment": "Malware payload", "value": "6662d598e161947334f0645aa249de2c5a92bcd4", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786492222, "uuid": "b8714794-830c-4296-8c82-95e99d8478e5", "comment": "Malware payload", "value": "62e8f8c1d8984497e0e9fd9b8e3324ba7facc05bceac366dd8fdeba2be966a4e981a5713fa56b4bdc177023f02b9e54e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786492222, "uuid": "b72cbd8d-942b-4ebd-8a03-b838a6aea9a3", "value": "T1F4E633B5CB42D0C1F637733256D652FDE99E86A22A1EB42D0897458ED03B70CCD399B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786492222, "uuid": "5319809b-8d6c-4bd4-8045-5efa34bf2b1f", "value": "393216:YSiRvarNOJcDpYEtE86vcgdnGA3/KiIXy5BOb6wKxH1TZWELXNPJfT9Baon:Y1RSEfE76ZGA3S5IhXTHdPN9xn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786492222, "uuid": "153f71eb-58ed-4d0a-a920-1772e84a0c36", "value": 14782215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786492222, "uuid": "e1c1c1af-1dab-4d07-982c-ff61130fc6e7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786492222, "uuid": "b6b3e8c1-441a-4cc6-9994-8f969dcbb748", "value": "msafd.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46e48338-959e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786464245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786464245, "uuid": "53f0f47c-dad5-44af-9840-69d9c3de00c0", "comment": "Malware payload (Mirai)", "value": "a0cb61f3856038578d308f02baaca00c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786464245, "uuid": "459cad5d-7f4d-413d-b451-a13103086fc0", "comment": "Malware payload (Mirai)", "value": "504cb139bbc3d10dc2febee86d854db2b59c5aa55c6a5c49619dea4d37e1fc11", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786464245, "uuid": "77d69e1c-31d7-4298-a0cc-9ec72c9262c7", "comment": "Malware payload (Mirai)", "value": "ccaab63ca557057692f8c2d430b147f02935bb86", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786464245, "uuid": "08a7a86a-99bd-456d-bb35-17462b585434", "comment": "Malware payload (Mirai)", "value": "751a97a62a75245e111cdffd23190e44c12669f41ba902ab4150932d2f71fa1cb47a5c6d600a0753ae8f998403fbe981", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786464245, "uuid": "b0de2bb0-f7fa-4c52-87a7-477a2b7af4a7", "value": "T1BD964B37B6A2859CC08BE1746ADFC5F3F974B4F40221206B27965A327F36E900F6D691", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786464245, "uuid": "ff4888c7-9872-4d64-b924-5df2147dfcfa", "value": "196608:f1vuDVYh66O/SDL8DCpWSjxkqgvzif3n47s:f1vuWs6O/uSvzif3n4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786464245, "uuid": "682e7d09-892c-4879-a529-b3e6eca3132b", "value": 9447087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786464245, "uuid": "12fae137-d3e1-4bfe-a8f7-ce0a7c7c18cd", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786464245, "uuid": "aab6c574-d495-45ab-82fa-326883560624", "value": "syst3md", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c08174f-955e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786436819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436819, "uuid": "eb87666a-850a-49bc-bfac-e0c6796dc417", "comment": "Malware payload", "value": "f5c979db94b775ddd0d15a4e11c981fe", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436819, "uuid": "7eb605e0-0565-4711-a3f2-c8c75c9dbf56", "comment": "Malware payload", "value": "5149dce73efa6cd9440d38eb1abb2ea61a7155e78334c8a9aea184ca1440337a", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436819, "uuid": "e7cd8a14-f1d4-4514-a4fe-5bc2e2117bab", "comment": "Malware payload", "value": "ca09c4de3cc120617374cd340d1eadf8c1ffc991", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436819, "uuid": "ef45b7c3-c869-473e-8dc8-930059fb22c9", "comment": "Malware payload", "value": "d7bd75c55df20ffbf6a2111ea0be5d6a4d8811679e17401f40fb51214f3db8db4411d982f5ee600969623c0881778dfe", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436819, "uuid": "9aa8f2af-e5f7-483a-a289-a579034d1bf0", "value": "T17552F17F0714D596C0FBD1ED54443A07A864AA3BC2DD9D193D1C4037A7E486E8CAE64A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436819, "uuid": "db43f16d-9b43-4ade-8573-ad3d2b82e6db", "value": "48:3vicETVjpaNTVj7xnYR7oouuuuuuLOuuuuunouuuuukuuuuw6O3ou5zzdyTVjvRj:ficsVjpCVj9DO4jVjJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786436819, "uuid": "5adee814-7eca-430e-82e5-325988098fbe", "value": 14407, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786436819, "uuid": "6d5b811b-265c-4d17-94dc-8b1c6bdd6583", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436819, "uuid": "d9a08779-b51c-4cba-a3d0-160430839fb9", "value": "bestthingswithbestthingswithbetterthings.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17600206-95a0-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1786465024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786465024, "uuid": "ef6c24cd-e08b-400e-bb4c-939b4e2830bb", "comment": "Malware payload (ConnectWise)", "value": "923501c32dd8132bef5a0d2d74ce3424", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786465024, "uuid": "6a39aca1-d7f0-44c9-a8b8-8f03d9eb7d0d", "comment": "Malware payload (ConnectWise)", "value": "5170262808745d7ff52e07e2b1ff79906f749ea407690f015e430e999f10072b", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786465024, "uuid": "369f3b9e-12c2-4916-839d-0e4229b3bc1a", "comment": "Malware payload (ConnectWise)", "value": "02b7c75c8083cca5ba8c360ab02540fbf6ca47ff", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786465024, "uuid": "4220a9b5-61ca-4e93-a8b7-03f9c45359f3", "comment": "Malware payload (ConnectWise)", "value": "b7271ce216dfff0297b21f9901465a5fadae23697b87d2a137618181667b38f7ca68fe774eb7491167866bafdec36587", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786465024, "uuid": "bb0ec5fa-95b0-4b6c-9dc9-d6cd2bb63c90", "value": "T11246E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786465024, "uuid": "a15cae6e-1dce-475b-af09-fa758a93cb30", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786465024, "uuid": "d9ebf3b1-6195-4570-9050-279b48e174f3", "value": "98304:azIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:ahfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786465024, "uuid": "4d13b246-c3f3-48ae-ab21-b5181d88b318", "value": 5641512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786465024, "uuid": "f2096467-6f6e-4175-86cf-385b7589c1a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786465024, "uuid": "29a9c2c8-6dd3-4ac7-9fd5-576f326e7378", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3d6295c-958c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786456723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456723, "uuid": "faaeeaad-a5b4-47a1-93b8-55fd030c4b8b", "comment": "Malware payload (Mirai)", "value": "731cbdf00a09350f48faffa219c2b098", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456723, "uuid": "2637484c-c0b5-4b16-9383-c72e64343ca8", "comment": "Malware payload (Mirai)", "value": "517742e50ce31bd44f99acce6ca5098033b3f2eae80bcdd31f1779c0898eff08", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456723, "uuid": "3ca8ed41-4aba-4714-b2b8-201fd3153971", "comment": "Malware payload (Mirai)", "value": "642ab566cb05745d6f7c445efc547a34463d58ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456723, "uuid": "a6920911-aeba-4fda-92f3-30279901474d", "comment": "Malware payload (Mirai)", "value": "852785fa9fb7992d8ff20a1d225daee095c3fb2389e485c7a61d39daec6a174d260db793758faf96ca0c150892f46bb8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786456723, "uuid": "39d5d463-0f88-4d0d-a034-6ae40ab16b1c", "value": "T13975E081FBE12E2ECDB7453A5F6B433527128E1AC297E3079958362C687B6C50F59BC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786456723, "uuid": "257830de-03f7-4ca7-b952-fc49bc02a173", "value": "24576:579P/oPEJ4OeOdReCgbKdlmA0Ii0LgAfnKpWPqkwUEj3rb/g/RiZ88bn:5RPi9rOqZbab0Idg4GWPszPb/g/C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786456723, "uuid": "439fd38c-62a6-4987-aa9e-44b17750cb5d", "value": 1649776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786456723, "uuid": "76e3f50e-4a67-4b13-9560-23d61d0038f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786456723, "uuid": "7a684376-9ce4-4237-8646-ddd481e49cd8", "value": "fSegv", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ed0104a-95d8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786489196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786489196, "uuid": "662067b2-ed98-4196-ac63-94346e91ac47", "comment": "Malware payload", "value": "f50573ba519b36c954b06bca9aca8b17", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786489196, "uuid": "62fed43c-01b6-42cd-9c46-fa2545fc6c33", "comment": "Malware payload", "value": "51d7278bcabcbcebf164729c55bd1f3c90548f6f43e52949d3203ca45b5d2a4b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786489196, "uuid": "a59768bb-3534-4634-9635-b2cb87674a8a", "comment": "Malware payload", "value": "5d5ed7f0fc1a42150a198b30db0625034e8f24e1", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786489196, "uuid": "cbe99e11-2322-406d-97dc-bff2517f763c", "comment": "Malware payload", "value": "fcacb11b408d5f33ad8f4c476cc61666de8ee0c256fafb8b18bed7d9667ee653a2147c40b3170b7f3fc01800dee69c15", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786489196, "uuid": "12b9a200-9468-4dac-8d28-170330997d4b", "value": "T18723F231A7D07241E53D78B7D187D17BDADF1A600F288F9DC922130CE6686A4636D787", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786489196, "uuid": "0db81d59-4712-4a47-af8f-751802de965e", "value": "768:om/rzVT5Uo0rWvY94A5L9kUIE6muNlCVDwoDC+risQu/v2vh3GVt7w7kZXg4GNAA:oQrzx5UozY+8jlKiDwK9+hmsqkAjDCZr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786489196, "uuid": "ac67b0ad-58c0-4060-bd4f-779ea03d267b", "value": 47707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786489196, "uuid": "455ab707-ada7-4912-9989-86f2351e5445", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786489196, "uuid": "65581c1a-79a7-4bb7-a221-6b45bc47a9a6", "value": "07409496-a423-4a3e-b620-2cfb01a9318d_HyperV-ComputeNetwork.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddd04d31-9593-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786459773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786459773, "uuid": "2ba4bd0e-a7cc-41b8-bdbb-a53c496f709e", "comment": "Malware payload (Mirai)", "value": "75c0453a6536451c755f9c1f9a167971", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786459773, "uuid": "53a330c9-4a7f-4265-b709-bd2d18ff49a2", "comment": "Malware payload (Mirai)", "value": "51f4374ff9b7cad243582f86867e14f4b0a4735a3c869815de090b2baa84102e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786459773, "uuid": "e107c869-022a-4487-bae9-6c633e34042d", "comment": "Malware payload (Mirai)", "value": "42b448172127697c6eee92aaa5d495ae1ad82784", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786459773, "uuid": "44546c4c-a7e7-4c5f-80d9-abc8de76f42d", "comment": "Malware payload (Mirai)", "value": "1ea356e46dbe49cd0aa0b998eed1255f0e745f37dc7a285ace49fda376ef06c1c949e6bfdfb0f897c3dd58cde913242b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786459773, "uuid": "66bda2e9-910f-42e1-8fac-b28d2b3e51bd", "value": "T1DD044A01B71C0D47D2A72EB03A3F27D193EFE99124F4E645790FAA899275E32504ADCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786459773, "uuid": "653652cf-3395-467b-9354-68251132a993", "value": "3072:jhDE8TWSPlrzvqVXfl24xH5XCm3sQXxlj9Fl3:jhDxTWSPlrjqVXflxxH593sQXnBFl3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786459773, "uuid": "37499ac3-9948-4e93-9c95-096c241c1327", "value": 178688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786459773, "uuid": "bf144cd1-1387-4f6b-9925-81a4a36e54af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786459773, "uuid": "258e0838-3522-4c22-9f61-2474c7789a61", "value": "sdfjgnjsdf.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e7ba281-9561-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786438192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438192, "uuid": "33bf9194-f493-4900-96a7-7a72ab3e6689", "comment": "Malware payload (AgentTesla)", "value": "3e52505991f7227bb5f9fe23637ff926", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438192, "uuid": "a51503d2-f755-432f-931f-b082bb8a9fff", "comment": "Malware payload (AgentTesla)", "value": "520259db65bb3fede04021912ede7bcdcb51021141fe2919f981de1c7b72223c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438192, "uuid": "8ef0fe8f-7122-46c3-9733-3964d0a8c699", "comment": "Malware payload (AgentTesla)", "value": "430d8581205d130d33453822915be91256808215", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438192, "uuid": "1f005bb0-40d8-4d6f-96d0-88c5a838ef2c", "comment": "Malware payload (AgentTesla)", "value": "4569cbaa1cb4fabbad9f951a841af79508406bfe71c15c587d700c51e3989d42503da49d045142cd73c4d243ddcba51b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438192, "uuid": "71ac4afa-007b-4a66-8fe6-5c592b10ac2b", "value": "T19F135B63DD3902654A0B13AEEC595A22C6BD8512CF1700F1BEEEE30D580AA9CF7BD51D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438192, "uuid": "badecbc0-c521-43ab-8d89-2082bcadf6e9", "value": "768:L9GeAumKOyDf+MVVRfsWdfup8dmKB9BlyAiE5XLgCyW5VYVMxpsRN6hg4AbY8HCt:L9GeVqIVaIupMflmEZAVMxWN6h8YMfqB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786438192, "uuid": "eb7909ba-63b9-4b4c-93e6-07c72fb850b5", "value": 42943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786438192, "uuid": "ea6b670c-b666-46b3-94a6-363b79835580", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438192, "uuid": "381c9781-f9fd-417e-90c6-7f23a69c5768", "value": "PS-PO0726-8406.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e481fce-9560-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786437521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786437521, "uuid": "5e80cfaf-aa90-4b76-b105-8c7323a6caa4", "comment": "Malware payload", "value": "302b19f2e591d372d9313ff3b34fae4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786437521, "uuid": "752d5137-9c87-47dd-8658-6bbcd4abb4a3", "comment": "Malware payload", "value": "522aab5133fe9e625237fac5f76c5d8bfa813c71fd67fed08e1c9d05d11f759a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786437521, "uuid": "cd108b10-8949-41ba-aaca-0cb4879665b6", "comment": "Malware payload", "value": "9d22a7f024c9d243e870f6dbee39beac8653130a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786437521, "uuid": "abc911de-5387-4ce1-b7e6-554213d9edd9", "comment": "Malware payload", "value": "cc5e412449798b4738b3a50904e6f7eefa9bb8dd4cb085aa44349946358347b1adcf0bb9fc2fe52f39247af737c170c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786437521, "uuid": "1eca5e13-6db0-47d5-bab2-2abb24bacc90", "value": "T126D40204FBC1A5ECC9768A7449FBC6A741337D989C75A60F6148FB7F3D70A418A3920A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786437521, "uuid": "cd31ec5a-1d23-4617-84ed-8441e3c933da", "value": "9be4f90f50c714bc00cc8beb2e137299", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786437521, "uuid": "75828f7b-3387-43b1-92f4-4d65bb157a0b", "value": "12288:lLiZpxyQi06NqfMa01XC3/lwwcgNK6prNp/:lIpxyQi04801XCvl5cgNxprT/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786437521, "uuid": "4b2a705a-1b10-4cc2-b1e6-4f4b75b19827", "value": 610664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786437521, "uuid": "09d3b6c2-4d2b-416c-bc6c-e12bf2c50d0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786437521, "uuid": "87d89bb2-2228-4d88-be78-a8c54b3c3503", "value": "522aab5133fe9e625237fac5f76c5d8bfa813c71fd67fed08e1c9d05d11f759a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eea478f-9579-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786448447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448447, "uuid": "a2654316-f201-4594-b7e0-0f025221349d", "comment": "Malware payload (Vidar)", "value": "d5c11a6b18590290d5861daf0f7aedef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448447, "uuid": "c04cc319-f5e4-44bf-b836-6972103e3c32", "comment": "Malware payload (Vidar)", "value": "5233542d50fd20d1ab851cdac985d60311ee422350f5f88f75fce71fe9826356", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448447, "uuid": "a9c59480-774c-4ff9-a136-acc65fff8c0a", "comment": "Malware payload (Vidar)", "value": "69655c5896f65abbe68ee76976b1a10aa9511380", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448447, "uuid": "0ffaf974-9746-470f-b898-32e7dac730d5", "comment": "Malware payload (Vidar)", "value": "1e53d62ac55a558e66c69af5440334cf158bd04d5473e44f8c318ba07aac6bce9f2da25f2d87863772850e173acb93c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448447, "uuid": "42f40100-daf6-48dd-ace4-6a0ce70eaa06", "value": "T1E8068E17ECA149BAD0A962324CB742527B3DBC4A1B3327D72E50B2B63E72BD05D75324", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448447, "uuid": "476e70f1-0c1a-457c-b5cd-543ae07017c0", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448447, "uuid": "1c37e38f-c5d5-4f23-b7dc-1b625df17667", "value": "49152:Wsb6KHImmvGB1WT7IbHCY70//HmNCdcx/bdFGI:9giE7wI/PmNycxdFGI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786448447, "uuid": "bb4d2a89-27cf-4fae-ba6c-188a19a61b49", "value": 3880240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786448447, "uuid": "979b14a4-9f0f-4319-83af-b3155c81f911", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448447, "uuid": "12bdeddc-77b4-4033-b028-c86a9525ab62", "value": "5233542d50fd20d1ab851cdac985d60311ee422350f5f88f75fce71fe9826356.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "030c39be-95ab-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786469714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786469714, "uuid": "10911907-9a33-4173-b043-ff2e5bee96a1", "comment": "Malware payload", "value": "a6d90641e752faa105e8b402567f4922", "object_relation": "md5", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786469714, "uuid": "717f55dd-bcf0-42e1-95f9-cc0a2fdf1999", "comment": "Malware payload", "value": "523cc1bf764ee9e8df099d3c513cedc66e33709b7a258b80a0fade7dee7193b3", "object_relation": "sha256", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786469714, "uuid": "38694050-1466-4e72-b7a6-450ce700860d", "comment": "Malware payload", "value": "349115d9de66572ef0328aaadf96671fee2199db", "object_relation": "sha1", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786469714, "uuid": "1079374b-60af-46c9-9efc-d1bb51fdca9a", "comment": "Malware payload", "value": "f9a47a7e88e68f49dbb96da968ab7c6473cc9501a86abee2476aad4f2506793e18c5e94c918f5d1d715912576e3f42b9", "object_relation": "sha3-384", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786469714, "uuid": "b5b86b49-5b76-429c-b4ee-dc0ca5e61377", "value": "T1D9F6332C9D978C5AC43CA2F137425A7A325C87F68A65E66C2134FC6A4713A351CF4ACF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786469714, "uuid": "37512dbf-a491-442d-b636-125bb729aac0", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786469714, "uuid": "86afaa60-d771-4339-beec-098b8c0ab444", "value": "393216:HmQBS+XD7YH3CN39vBCTzj+t7tXn4/T4fNAE2td:HmQBrXYHsNvyj+t7tlN327", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786469714, "uuid": "55ac23fd-3589-4bdb-a77e-c2c8e4150c14", "value": 15348736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786469714, "uuid": "3e600ead-8933-4e49-8f47-366d7bca3f72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786469714, "uuid": "3df66533-6dd1-46fc-92a7-bf7b30a64feb", "value": "Installer_v23714_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de64e11c-958e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786457627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457627, "uuid": "a6d1a7d6-3f9d-46ab-9489-13f9df0fab82", "comment": "Malware payload", "value": "1ba4b50e879ecf4c376abd9fc854af81", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457627, "uuid": "1c409a01-ca5c-4df3-93e3-360d7d7d4dd6", "comment": "Malware payload", "value": "527f1274a417680e4a432d3af7c7fb1ad28cd15d0057b293081e26a088b60ef5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457627, "uuid": "1e015fa4-82ac-4512-9bf6-87b2b83ff5d2", "comment": "Malware payload", "value": "f1339e5ac6a19ea7640ebda10dd0237876327bbb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457627, "uuid": "e14c57f2-5264-4aa3-941f-253cdc474022", "comment": "Malware payload", "value": "9957ba6076393f18cf07446663d211951adc9257bd8159ce6b808bbcd45a334116e4cf9c12862d1f857a7410fb6c12ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457627, "uuid": "76496376-a444-4a08-8347-0c7895fda6dc", "value": "T131A10C03EA82DF37C41321F055F75B358EA0FC2E5C62EA42F332BEE589256D56216368", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457627, "uuid": "7203ae84-ee66-43d4-bf02-821edb8caa90", "value": "96:fB4x1yJ6U8AZAU5qsXUiBX2LswwCE7NJ5XRfqaMm7f4L+k:fi86U8A15kA7NJ5Bf3Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786457627, "uuid": "885b6229-5991-4505-8fc0-3a7f5f957a4b", "value": 4756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786457627, "uuid": "c1ba5826-d642-4c9b-b3e0-0704ada18d38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457627, "uuid": "eeaaf72b-0a50-4f46-ba04-795ec9962e94", "value": "dlr.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80b318b1-95c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786480233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786480233, "uuid": "8e20a9e4-f3d4-4666-932b-b5aec79f009d", "comment": "Malware payload (Vidar)", "value": "7ec80c71c93b44213187da90e02bd50e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786480233, "uuid": "af3b0739-706e-4fa5-afb6-3ac0ee056434", "comment": "Malware payload (Vidar)", "value": "52ce6ec99185d06970136b000f8ba69aff8fe20e494527251c987137ddd0bda1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786480233, "uuid": "f4e59a36-530c-40b6-b2b4-57cda9ff3230", "comment": "Malware payload (Vidar)", "value": "4f97a2ac4315ffaf267f90847706c3e72e352f6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786480233, "uuid": "be8145c5-7849-4a70-8d09-244c04072309", "comment": "Malware payload (Vidar)", "value": "0569a96e43c4a6fe8c6df26faff2d794b3c6d8275f5996fd2855d847084694c469af77c84798f3f11f67bf293079c47a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786480233, "uuid": "2dde6af8-032a-4e6b-bc6b-46148590de3e", "value": "T182169D0BACD159A9C4AA9332497602917B7CBC5A4B3633D73E50B6BA3F327C18D35B41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786480233, "uuid": "772a6163-dcd9-41bb-af2c-c1b43f8e587b", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786480233, "uuid": "e53560b0-8a3c-4c8a-a092-2e4e7872a282", "value": "49152:Y3vgC9oOIUtr3IfQ7nEgSV6Q2F8oCODTX9xK:YfgGIQ7nXStY8FcTtxK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786480233, "uuid": "8030bb1e-8ee2-478a-94b1-fa1a48a23b04", "value": 4039584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786480233, "uuid": "93540607-7636-4f9b-b903-6d886c4434ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786480233, "uuid": "98240308-12d4-4ac8-b4d6-f6c132004c1e", "value": "52ce6ec99185d06970136b000f8ba69aff8fe20e494527251c987137ddd0bda1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6947711-957d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786450312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786450312, "uuid": "ffd4fffd-3ae3-4f9c-92bc-8f5651745fb3", "comment": "Malware payload", "value": "461a0b08697b530ddf64d68cf9a85da0", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786450312, "uuid": "236ea286-f73b-4b50-9cdc-711bbcd38608", "comment": "Malware payload", "value": "52d8bf6cfac5d44544cc86d0efd57cff5d0500d05a7e923259f9e636db0a2299", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786450312, "uuid": "8b78aeb5-88fe-4069-b3bd-eac2d6e2e49e", "comment": "Malware payload", "value": "76f7bb0accab57b94aac6937e98faf1fea94deac", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786450312, "uuid": "8cb82b13-4a05-4d15-b02f-6a0e0c316c37", "comment": "Malware payload", "value": "fccc0f949ba2b3388b6c583d360a16375b0ad4e23ec804fc0d488a481881034d699d1de65ba0d071145d1157dc119efd", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786450312, "uuid": "9dc3d20c-66db-4777-afc8-66a20ae4feab", "value": "T1E5B6339D68EF58EEF2702B346C80409731697AB28FD6AB2723C58C462DB16C75771B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786450312, "uuid": "441d6d55-6109-472d-bd97-726b3f2ce4e9", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786450312, "uuid": "0a9af4b6-1eb7-4479-b73b-2b82c8d0fca1", "value": "196608:1H+ubuHIdA45g9i365LpSBKHkxBeChAimFBRJ1g6OzDRgBbRVqVvXxF2pocp:ptq093KdA00BepieBRJe6aui+pb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786450312, "uuid": "1e6c8166-2070-479d-8b5f-8445d5242126", "value": 11001344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786450312, "uuid": "db0386f7-9b98-4cd6-9497-8f27f1e8d7ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786450312, "uuid": "8f1be164-8454-4b3a-b798-d45808490063", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8686c760-9579-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786448460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448460, "uuid": "c3c2201d-8154-4a1e-8abf-32fc0f56ab83", "comment": "Malware payload (Vidar)", "value": "d40907379702b8571b5ac78590c7e24c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448460, "uuid": "dd402cc0-0901-4b9c-8b52-ce49310c3ea4", "comment": "Malware payload (Vidar)", "value": "53144fa4271d94583e8c93669bbea79ee403b4593ca3ff7351cd2fb3d7ed3272", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448460, "uuid": "108d2af7-c570-465a-9ab7-b40fd486dfa6", "comment": "Malware payload (Vidar)", "value": "4ffa28c6e170b1e2182e07530e317e227950d48d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448460, "uuid": "b811501d-5cac-4c53-87e9-2dfd246d4d2d", "comment": "Malware payload (Vidar)", "value": "edb75e62ec74a76a622fb4908c2880d66d37956a3bf8790ac205a623d57b9541e6a86e5b101312b91b3cacd409efd9fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448460, "uuid": "075e6516-9c09-4936-80a4-791dd9f774b8", "value": "T10B068C03FED14CB9D2A9A23248AA42517B3CBC4A5B3277C31A90B7793EB67E05D31754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448460, "uuid": "355a9063-2689-4cb7-a457-bae1d8f8530f", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448460, "uuid": "2e3e686f-2e6f-4aa2-b72b-4afbfd50a41b", "value": "49152:HxE3rfEpx8wU4ym6UuI3LojME0YueJKeCEhER:HgKZyzUuILojGesejhER", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786448460, "uuid": "3f5b78c6-e50e-44f5-8728-206d45a5af84", "value": 3852720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786448460, "uuid": "e67444e2-fe30-441c-8f07-cd6ff7e0d1f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448460, "uuid": "1011ebcc-9707-463a-aa32-0f13f7d8392d", "value": "53144fa4271d94583e8c93669bbea79ee403b4593ca3ff7351cd2fb3d7ed3272.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abb67d06-95bd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786477728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477728, "uuid": "63518b2d-48f4-4fb8-945a-e0f2033710d6", "comment": "Malware payload", "value": "3586321bc083728ad1ce169113649a9a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477728, "uuid": "8d4f35a3-e480-477c-ba69-2924502769a4", "comment": "Malware payload", "value": "533a79c053dd3c1351d7775f87e92ec012b7e97fdf1b0293a39e98508a41a609", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477728, "uuid": "3fef0f6c-bcd0-4a28-a2bd-1b25f66963d9", "comment": "Malware payload", "value": "3c1c210c73c269e3683d7360585985d63b5f12de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477728, "uuid": "4f38218b-0a5a-4c42-827d-14aff66ae84a", "comment": "Malware payload", "value": "848eb801ea7f72df1440669537e58ec83b0491b93a9fd8d74f30a583d17e20e2ec5c50561e35216e2bb5fd8a533f03a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786477728, "uuid": "67ea5daa-cd10-42ef-82e7-394b958623ee", "value": "T18F13D681F287D962C40B143577BACB773702B8E61F6AD2108965EECDFB675D069A0433", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786477728, "uuid": "6f89d140-50af-4387-b4a8-86cf1c436dce", "value": "768:ao2ls5UsSyZCKDttuF+/uASaNk2qh6Y9QRDDvoWsPkf9EuGlAbiMUvfqjwGatOFS:aC5NkX01lEuJWvfq0OFfa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786477728, "uuid": "b587da40-9d39-41c1-9abe-dd946b5341e6", "value": 44504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786477728, "uuid": "9ce87b1e-4740-48ce-9afd-766b602125fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786477728, "uuid": "81490105-cda6-4af4-baa5-e219facdcb1b", "value": "main.armv4eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83b7214e-959d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786463917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786463917, "uuid": "13b54818-a141-43db-ac32-0c9fc64b0e62", "comment": "Malware payload", "value": "23e1b5834b679926bdf51bae4d811acc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786463917, "uuid": "f912fb76-068d-476d-b9f9-262881277385", "comment": "Malware payload", "value": "5379ec47df6a69b7845065660e984f5a857076ac5b40ea0ccc55162723c7f746", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786463917, "uuid": "f10b9c8f-6078-4cc0-bb48-be602c557f0e", "comment": "Malware payload", "value": "cdd942a451f00340b2fd6ca26c5e6de2ad135c32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786463917, "uuid": "7d695cf5-a265-4d09-8246-b5a20280f0ff", "comment": "Malware payload", "value": "bec6f66b9c43d3e1bdec6304a5b731ddff2730dd95e7582994e4d760857a1dbac4d61af3dffdc962301e840ecb1b853f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786463917, "uuid": "8940d814-0254-4b4b-aafb-4589fb9d4b17", "value": "T124D5238A68F167B1E476C7718F83E4BEB02ABB9457154E8BB9CDA8004D634B45C37335", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786463917, "uuid": "5bfd9374-7c94-4702-bcf2-0eb3b5547c67", "value": "44140cbbe125df54636c585913f74c75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786463917, "uuid": "c577f4bd-8bc3-4daf-99f0-192623ab47c2", "value": "49152:fvN8QnBpAq6ONjqwMf0ZrTZ3aJ7z08vmCFn/FK1XN0Hj+m9:fCQBz6O/M8rKxLvbF/0gh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786463917, "uuid": "2660c4c0-8cc8-47dd-8e8b-06fc540ffb7a", "value": 2926080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786463917, "uuid": "b0182221-b165-4b84-b1d2-81ad0a8a237d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786463917, "uuid": "0052c3be-dd9b-406b-b310-c63ba8ec7ad5", "value": "5379ec47df6a69b7845065660e984f5a857076ac5b40ea0ccc55162723c7f746.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62da0bbc-95bd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786477606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477606, "uuid": "7467bf9a-b6a9-40f3-9056-10163fa7060b", "comment": "Malware payload", "value": "b7d97912f85c60974fdb542e18b84ab0", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "controedatoerpestanavidroslat-com", "colour": "#50F859", "exportable": true, "hide_tag": false }, { "name": "formaecias-online", "colour": "#5EACEB", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ningyinfiniticomerciodegases-com", "colour": "#061DF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477606, "uuid": "20d25fae-bc15-4acd-ae06-5ab1d72788d2", "comment": "Malware payload", "value": "53d3d221367d88796ef4521042915ab765da70661fb38eb72953ac2cb294e5d1", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "controedatoerpestanavidroslat-com", "colour": "#50F859", "exportable": true, "hide_tag": false }, { "name": "formaecias-online", "colour": "#5EACEB", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ningyinfiniticomerciodegases-com", "colour": "#061DF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477606, "uuid": "056c7046-4704-4928-a819-d847977b8115", "comment": "Malware payload", "value": "000a48490b9b22797b6704a93f43c44aa9cee45f", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "controedatoerpestanavidroslat-com", "colour": "#50F859", "exportable": true, "hide_tag": false }, { "name": "formaecias-online", "colour": "#5EACEB", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ningyinfiniticomerciodegases-com", "colour": "#061DF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477606, "uuid": "1bb1ee25-ed56-49bb-90e0-3d9e246cb917", "comment": "Malware payload", "value": "934d63544d59460515b3ece987b9d07c3927bcd6dc167e92ec18f81c2368382fb7494a0b24c51f415df9dad75b6a2fb2", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "controedatoerpestanavidroslat-com", "colour": "#50F859", "exportable": true, "hide_tag": false }, { "name": "formaecias-online", "colour": "#5EACEB", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ningyinfiniticomerciodegases-com", "colour": "#061DF7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786477606, "uuid": "1b402bfb-73ec-4aef-91bb-b54b8ed1b952", "value": "T1DAC7338B50984B3EE1799075961F7D7F0281EE0278C40D52E22AF9BA73F3B5355D8AC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786477606, "uuid": "bc6909b9-25f1-42f1-8818-ddd42b1332c6", "value": "1572864:q5ED794S8krw7gJu4hnjEQ1Nony98iinIYbb9ZyvNr9s86VR:qI7938F2HjEI+aEnIYWlr9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786477606, "uuid": "17b48674-ebb8-4f97-8af3-26c264bfcead", "value": 57876480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786477606, "uuid": "400e14e1-e386-43d9-93f3-db07769b51b6", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786477606, "uuid": "ada316d3-831b-4c15-a1c7-bdfc8490d88f", "value": "3465exandriaburger456.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aa27199-9572-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786445460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445460, "uuid": "dd1d5536-680b-484c-aea8-295568af97b0", "comment": "Malware payload (Mirai)", "value": "1e6cb0736f37fadd466906f42b48841c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445460, "uuid": "c1c5f989-0b87-46bb-b067-102ab0405464", "comment": "Malware payload (Mirai)", "value": "5461c955af9b8b817fcd6185e12d2a1d728b4b55752a35b45fd117e273e02340", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445460, "uuid": "7a2ff588-013b-43b0-bae1-235e4e7e7e3b", "comment": "Malware payload (Mirai)", "value": "922eeb72431ccea49764050911019be9c8fe288f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445460, "uuid": "94e8711f-6b94-456b-85dc-0331e4402ae6", "comment": "Malware payload (Mirai)", "value": "10f9edc827450dd1027737b898835c02c7cf47cd42205a4fa6c001c9a334752aee4c59fd9154793802608429d7c377e9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445460, "uuid": "2685f8a0-eb24-44e5-aebd-bd1dea478d6a", "value": "T177F38D63CC257E6CD218D8B0B0319F7D2B63956581831FAAA6A7C2B54447ECDF5093F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445460, "uuid": "557705d2-3498-46bf-a68b-ffef7314b9d4", "value": "3072:sIf9dR+PKDIqtTQiaRXuEG5DXWpgIs8LNHl:9fFfQiaR+rmpw8Lb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786445460, "uuid": "6f720db8-a7b9-4dfc-94f4-22fd04b9440a", "value": 158980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786445460, "uuid": "1e3f82a2-ab88-4b56-b0f4-fc14826d418b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445460, "uuid": "9fbb5c56-50ec-424b-a9ab-8a991f221a08", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c85e7072-957e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786450718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786450718, "uuid": "2a7a7ed2-3c30-409e-9277-e5958f013096", "comment": "Malware payload (Formbook)", "value": "1446c7d0ac4247e20c57fc07cf53693a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786450718, "uuid": "e89f8d45-7047-40e1-9466-dd0dda8ee00b", "comment": "Malware payload (Formbook)", "value": "54692596ddec105cb0a4de07623bacd32fb45525b041114b71db1ceaa1a3e176", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786450718, "uuid": "e5df4d9b-8c73-4f6e-b076-5ac5fd2e1191", "comment": "Malware payload (Formbook)", "value": "4e9789fa88892713c4f640b34c5c599d13a188d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786450718, "uuid": "36e09bc5-f534-4d26-8b3b-9631d62a0d09", "comment": "Malware payload (Formbook)", "value": "6f0cdf2cfca884392a1fe2e9cc2a56922278e05e1480c5f5a5bfc593193762d2d81e3b670f512fae9a801dbc90fd6571", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786450718, "uuid": "6b4130f8-46a5-4e62-84c3-cb8b01c86bbd", "value": "T1E52501542629DF06D4628BF12871E7B91BF52D98BA10D3138DEA3DEF7875B0428493D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786450718, "uuid": "4c442f50-bdba-4180-88bc-00c2a29e6ad9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786450718, "uuid": "84fc12e0-2835-4ee3-a707-55b81b9d2365", "value": "24576:LRAddApFjgdw0CKuPrKefnkdumx5bflQ1:LicpFjiw0CK8nkc6g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786450718, "uuid": "8e390206-5c60-4767-998c-5e7cd4455c71", "value": 1001472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786450718, "uuid": "32d79a47-5af9-47b4-965f-cfa489ba7569", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786450718, "uuid": "b5483c00-195e-4df1-a852-1c4210e81314", "value": "54692596ddec105cb0a4de07623bacd32fb45525b041114b71db1ceaa1a3e176.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f826a595-95cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786483869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786483869, "uuid": "c1c4b888-8438-4719-9469-d66d97d9676e", "comment": "Malware payload (Vidar)", "value": "02cd5817de1f42af015d331e0f9f375c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786483869, "uuid": "40570697-e09e-4de8-aa96-53af14e9e5a8", "comment": "Malware payload (Vidar)", "value": "547efd85a19d88bbbe304ca86cb0b19f8a1bb2c1a06a855329423fff8d56fa4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786483869, "uuid": "8de0bf20-359f-4986-b2a1-b92ee2594445", "comment": "Malware payload (Vidar)", "value": "caa2304fb7852edb61b42b8299dea580e21c30d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786483869, "uuid": "2048df90-e46f-40d6-b21c-6548dcf3e813", "comment": "Malware payload (Vidar)", "value": "09ff55ed80d32941983129fbb47faa29247555992bec13f33c1399a4cd637f767d170ca90c08ee54bf4bb4ae188b5796", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786483869, "uuid": "33672c5b-6c7b-4374-8de3-c1635e8b8af9", "value": "T104D59D0B6CE109E4D86A673288B612967B30F8460F3667D72E90B7782F727E4DC79750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786483869, "uuid": "4fe6e8ca-a5f3-4225-88d3-e1c71f91f882", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786483869, "uuid": "84f6bf92-caed-4fba-8e23-c0712cf50c31", "value": "49152:z124yaD0luir8iiuphfVmVeM8ps2GNJTcgec:z1kRief+eM/nrc3c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786483869, "uuid": "606f14a6-c7c4-44d7-b14c-9dcf164dd57f", "value": 2957720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786483869, "uuid": "5e69e307-1b04-456f-ad9c-780cad2d90e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786483869, "uuid": "a3ccbb49-4232-4c3e-a93b-a1267bc1634c", "value": "547efd85a19d88bbbe304ca86cb0b19f8a1bb2c1a06a855329423fff8d56fa4c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4d1e0c7-95c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786482038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786482038, "uuid": "a68f1788-4a2f-4b31-8a0b-481f3e7d183a", "comment": "Malware payload (Vidar)", "value": "99ffc8a9e591a0555746ed22454f1612", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786482038, "uuid": "ba8d11fa-1047-41e2-a07c-025f626f2842", "comment": "Malware payload (Vidar)", "value": "54f7898e2eb3a82c8856699279f015571aa937689296344aea7154925368daac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786482038, "uuid": "676adf9a-c478-4402-89fc-376b58010388", "comment": "Malware payload (Vidar)", "value": "5ad30d8f04128468176c464ad001934068e97545", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786482038, "uuid": "2d4f0e34-4be3-4e35-8926-358c147313d6", "comment": "Malware payload (Vidar)", "value": "030d685f06984c3cfc0d0d5e66dec8659edc9104d700defd62879f0e5359b5794e6b140513cdc77c85f91355c6295bdd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786482038, "uuid": "618b2168-03ce-4a17-957e-fe92f240bdfd", "value": "T1D5467C03ED9448A9C0A9D73988B67256BA38F85D873133E31D717E362F2ABD11E35790", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786482038, "uuid": "cef4801f-f8f3-45cc-b0ee-7885cf034b2f", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786482038, "uuid": "571dc173-c2d5-4fe7-bf7d-63ad5735180c", "value": "49152:9zbZKcekR1zOpe5j0apWtIRkCxcly5aRQE+Yde3NyhrkAh4cjWuiBfIwc0Os/VAK:9sdgQ85cjWuiBgUO+cMX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786482038, "uuid": "16d8ef86-7da4-4517-af96-2b031a1e0143", "value": 5745152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786482038, "uuid": "e078d96c-7804-47c9-9943-b7e6f6e0af3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786482038, "uuid": "2747b06f-cd98-413c-910f-5394dbb83704", "value": "54f7898e2eb3a82c8856699279f015571aa937689296344aea7154925368daac.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ebbd790-9592-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786459050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786459050, "uuid": "7ed24706-f125-4039-b998-d5a166cdb493", "comment": "Malware payload (Formbook)", "value": "36daf98450a13eff794239bd214efa1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786459050, "uuid": "bf0b94cd-3cae-4604-af50-d13ca6dd4897", "comment": "Malware payload (Formbook)", "value": "54f7a59d215988a0b672022a0d0958861bbd154eceb2df3ee1f5086e7abe2f0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786459050, "uuid": "7ee770fc-afb1-4e88-ad83-1d544dfa1e2c", "comment": "Malware payload (Formbook)", "value": "96e452e303cf1726be92bedf00b023926f7460dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786459050, "uuid": "a63f30e8-8bfd-4c8d-b10f-e7fa5c8c9c47", "comment": "Malware payload (Formbook)", "value": "4a206ac6e60acf01c5d61d08b59f37e432b9bfb2f9029c63cb8bcd3aa177c214cfe216a87a9dd09c2b8e13510f3a6efc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786459050, "uuid": "533de0d3-3f01-4443-8c0d-2067cf901b9a", "value": "T1AFA402507751D8A3D2A14E3019E4EB316AA97E785DBB0117F3E67F0FBC727462C1A222", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786459050, "uuid": "19f85806-4d60-48c2-b0bc-f5501676a76b", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786459050, "uuid": "70482db8-05b6-480c-a949-0c26f5e823e2", "value": "12288:6lnNAYjCVSo30oEN0ID/DMpPKSfa6d8E:inhj/o30oo0ID/DOfJB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786459050, "uuid": "f86d8dfc-34da-4b04-9326-f93cbad50f7e", "value": 484192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786459050, "uuid": "6918a91b-e889-49a9-88ed-4008ba4e10d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786459050, "uuid": "594aa1f2-7db6-47ea-bbed-783749072356", "value": "ITM00092928838.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74f7540a-952f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786416648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786416648, "uuid": "2e25ee04-bca1-4a09-8979-7b0d9e82b880", "comment": "Malware payload", "value": "742bcca113a2828ed3275bd00e311971", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786416648, "uuid": "7b310fb0-14b5-46bd-bc3f-60e42ac9aa33", "comment": "Malware payload", "value": "550e7cb1ea389627cf41b86499f7aa88386c9ecaa6aaff48fc59f69981d31805", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786416648, "uuid": "597213d3-3891-4e3e-9da3-cdf846482473", "comment": "Malware payload", "value": "277f89edf1d0d929071aa073d2e1b773e794bf76", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786416648, "uuid": "40d06640-c68c-406a-95ab-5ff0a6697e8a", "comment": "Malware payload", "value": "6b68314886f3f603308f1ab81ab3174c40ac9f182cf5f7edbc539af9e718500db05246b063ce74e20fe546661a132fee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786416648, "uuid": "571101f2-a203-4eb7-ad36-8dd41f228b5d", "value": "T109E2B502A603C4F2E51321B116E2DB624930FD77AA299507C374AFF6AE991C0E65737E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786416648, "uuid": "49907a84-5aaf-41a3-8c14-95ae20c88079", "value": "384:fB56EokscMq26uE9+BvjN3vRbqpKvVi8jvtzMNLOHGsvyEi4aYIIUWr4d:OEoks8KBvjN3F2KdTgRQQIU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786416648, "uuid": "ca772f14-98af-4b14-9ca2-0b6f57d21bf6", "value": 32264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786416648, "uuid": "2ea6cb43-6022-4ae3-be2b-d59ca7c0e427", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786416648, "uuid": "6704a86a-3764-48bd-8bd1-6d9f00eae182", "value": "main.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb119765-9594-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786460171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786460171, "uuid": "8c6be99c-fd76-4fbe-a387-512217ac4528", "comment": "Malware payload", "value": "1fb1c52cd84fabe7fa436da568a849f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786460171, "uuid": "8652aa01-08d7-4a90-bf0e-deeb6768a55b", "comment": "Malware payload", "value": "55471133ed1f762d9b6654fb1ec8e8f21f40400cd191163668f82de0f2b3b713", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786460171, "uuid": "87d59b1a-bb05-4bd7-9f44-496819977de6", "comment": "Malware payload", "value": "2406db9d39d46063bb53683fa24795865e46a366", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786460171, "uuid": "c2979532-9a71-47eb-8986-cd124e8e1b4c", "comment": "Malware payload", "value": "3925302e17dd65f617e87be34623316dc76ef8cd65cebcc7ae243a6570982d31c7189e2ba4a46fb551c83ec245747f23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786460171, "uuid": "499ef679-037a-4a87-ab80-52113a78b8b3", "value": "T1F1F56C56E7581068DC26D3788967DA27E7727C05077187CF22D83A6B2F737E00E3AA52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786460171, "uuid": "8d30def6-eaaa-48f2-8737-f010c7ee0b51", "value": "dade855067f9c81aa7b38e6b59820156", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786460171, "uuid": "75dabdb1-51cb-4a23-8807-b64e931aec9b", "value": "49152:FRavy63xeBtulAeDM1F4zEVecV0bfla15nU/V+RWksYVvGSbhcq9Z+lLN8UKDhOU:FygBfEXE5uxW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786460171, "uuid": "dc7c120b-d896-4956-abbc-a1390f48bec2", "value": 3347968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786460171, "uuid": "a117ba9e-88f6-4dc9-8f8b-f8dd77bdf026", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786460171, "uuid": "e5dba4a5-60b7-4e3d-abf5-2da743be0722", "value": "Vantix Injector.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4bd8ebd-955d-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1786436592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436592, "uuid": "947a59d9-5d11-4d9d-8ffc-9e08967a7b2d", "comment": "Malware payload (ConnectWise)", "value": "685b9bf0b0b6de8005c8514be68fcc04", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436592, "uuid": "7f5065d7-1708-46c9-aeb2-e04122675ebb", "comment": "Malware payload (ConnectWise)", "value": "55a047352a1c29a272015f6cb895af8a1f6007622f252388f5808325377c4bef", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436592, "uuid": "58d81f0e-10fc-40f4-845a-9caeb208c2ed", "comment": "Malware payload (ConnectWise)", "value": "e3a55f9bf2c263f6eb0317df548848ae3c810978", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436592, "uuid": "a0b6b8de-4d4f-4065-bac6-164928f0244e", "comment": "Malware payload (ConnectWise)", "value": "a61581b555b347a2df564c2ad720205a17b73e70675689953d1d1ebc3d071f959b49f5e210285bd9cb1bb8593919031a", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436592, "uuid": "6d78c751-cc6f-400c-be22-3a4503cdb122", "value": "T16DC61201B3D689B5D0BF0638D87A56665A34BC049712C7BF5798B96E2E32BC04E32377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436592, "uuid": "da35853f-b113-4169-b563-3e7b0023a2dd", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436592, "uuid": "521ea76c-2752-43a1-bc48-2014d1cb329a", "value": "196608:J1TfefPqYQyiixtMjGZ1jhlrwUNQyiixtMjoQyiixtMjXQyiixtMjBQyiixtMj:JRPnjGrrGPnj5PnjgPnjqPnj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786436592, "uuid": "5a92d9b7-9a86-4a83-8e8b-01df90485b0f", "value": 11624144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786436592, "uuid": "61129a44-b5db-4025-9d2d-6600197e899e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436592, "uuid": "d131e71b-bcd9-479a-8a8f-6e0154e86c9b", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e20b8d4-9561-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786438165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438165, "uuid": "30ef04c0-2362-4cba-ae9c-ecb0f74020cd", "comment": "Malware payload (AgentTesla)", "value": "652fd3c31ffdc63bfd9f6103e4afb9ed", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438165, "uuid": "3d07a00c-ca27-4aa1-8003-2c6358d639c9", "comment": "Malware payload (AgentTesla)", "value": "55be9d1e2a4edeede9d8223d5f932be9233872df7239501f2f3c305672bec4f2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438165, "uuid": "ed2761a4-2263-4e54-82b3-1841b1dc5823", "comment": "Malware payload (AgentTesla)", "value": "b67c9583dfdec1cc55dc3b0e06b2cf4a4b2867f3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438165, "uuid": "791410f5-45d3-4985-8e7a-6e56a8af3dbc", "comment": "Malware payload (AgentTesla)", "value": "c000e5d6918f83387688f9ee5103fd5d0aab14854c717219721e8daef5613a627cd8b6e4de828dca85f83c0ed22e9450", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438165, "uuid": "d712393c-0701-438a-b0c0-bcacd4c3a5e2", "value": "T1F9640C34ADFA502A7173EE59CAD475A7EA5FB763372E9819009203860713942EDD233E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438165, "uuid": "0810edd7-3995-4de0-bf2b-964751b14043", "value": "3072:wrL9MTtMPMbuhn+ngMrJrFtLtOnam74YbV0lkRmhI8cp3yYAYJ1V3/Jv48c3sHhj:wlawIh+7Tbmu8GTA0Z48c3sZ8EZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786438165, "uuid": "2c155226-1fe8-4d55-a162-2eaadd3647cb", "value": 326202, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786438165, "uuid": "ce00667a-b6a5-40f7-9322-6d67df2a9ee1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438165, "uuid": "c96c0ba4-7d4d-449c-b229-de33039a7447", "value": "PO_1000023766A0_1000023763A0.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98089fec-9573-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786445912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445912, "uuid": "2199ec24-037a-4337-ade5-9a080b3f0f66", "comment": "Malware payload (Mirai)", "value": "7ad8006586ba66a38532ecc617dcc011", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445912, "uuid": "dc7814c3-d2d1-4a1f-baf3-8ec41564e8ac", "comment": "Malware payload (Mirai)", "value": "565030fd3bed1373501ec03589d7f5af7c024dfe1deaff136d4dc87eb206b5ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445912, "uuid": "ba93c832-855f-4dd5-982b-fe4654b44448", "comment": "Malware payload (Mirai)", "value": "46c53cf16d4cf297c5cadae55c9945c07a2d8b79", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445912, "uuid": "1486c734-1415-4924-85ec-ac842046112c", "comment": "Malware payload (Mirai)", "value": "c94b7b5a28a03515f1b487e301a3f3794c111449e83c6278c063f4a9a817f3bc4cc388cc9476824e408d9d00627ae7c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445912, "uuid": "932c0381-4af9-4345-8fe2-73ed5a82e21c", "value": "T182042A86FC518B53C6D626BBFB5E418D33265768D3EE31039D255F20378A96B0E3B242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445912, "uuid": "2c91958a-8bff-4143-9dae-dc5739b4a144", "value": "3072:CvJcUzVHT4TKbpKpn7MWDKM4ZGE1AW1Lq3:CvPNxbpKA894wE1pJq3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786445912, "uuid": "cfb6c738-d0e4-401f-bd81-09dc1a1ffa49", "value": 174444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786445912, "uuid": "3622d9ef-48f2-4ad2-904a-0a2eb790ab0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445912, "uuid": "16c5321f-69be-40a5-856f-efe54c183230", "value": "sdfjgnjsdf.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "284a0546-9569-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786441430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441430, "uuid": "f8acc1c9-a661-4378-8860-eb0eaa4fde1f", "comment": "Malware payload (Mirai)", "value": "42d3d30acbe8a8c9bf5397fd11ecef1d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441430, "uuid": "293c0e87-5ec1-449d-8916-65da8b7366db", "comment": "Malware payload (Mirai)", "value": "565c2198267c0fe3cab574243a426f8ff824a4499522148d5958d53b1cf22fc4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441430, "uuid": "6f146b60-bdcf-4d95-af8c-6b7b0c54ff9f", "comment": "Malware payload (Mirai)", "value": "b3192decf56c5bbb994e6563c598a5fae52e13f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441430, "uuid": "dc19fb57-400d-4827-a9e0-bc94297a88bb", "comment": "Malware payload (Mirai)", "value": "ce4799b33a0735356f022b7fec2b702f0a59ce1cb2c89ff4f8f4db3cc8c914131929bdbc42a28aa7d8cd45f527fdb53e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441430, "uuid": "d190acbc-4b2e-4d78-ad5a-9749a300aa6d", "value": "T103937CC4F683C4F2E84305B1507BE7379B32F1B9101AFA43D3A99A72DC91551EA1AB9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441430, "uuid": "35744936-8d6e-4b1c-9a6f-23f848ea178b", "value": "1536:W/QCZaxGdvts3FVVPhE9YxPu++g7bQUIKqI4FrS4LSK:WYCZa8dvm3nVPhAYxP5RbiKfUmDK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786441430, "uuid": "4186fbc7-4cf9-427c-92ff-a7ed9b3871dc", "value": 89992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786441430, "uuid": "d7e2d29d-4f49-4922-9c68-71561e93d1bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441430, "uuid": "045a828f-1dce-494d-b0ca-12ec9eb607f0", "value": "bot.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bac55fa6-95c2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786479901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786479901, "uuid": "512db2a7-a101-4543-8989-399807b392ff", "comment": "Malware payload (Vidar)", "value": "eec6f369441b06d5fd73d1e47e491b45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786479901, "uuid": "95743754-b15a-4a6c-a14d-114e18d2a172", "comment": "Malware payload (Vidar)", "value": "56e83d170cfc0d3c9e68ac872ad26e45d0b1686a965cb78d950ad03b551e2b44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786479901, "uuid": "f22d26f4-126b-400b-b885-703060420aae", "comment": "Malware payload (Vidar)", "value": "7e09a85b69dbd20727635070827b29df9d093ddc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786479901, "uuid": "c2e137c1-8ebe-4209-93ad-3bef8d84306f", "comment": "Malware payload (Vidar)", "value": "8f891d094cad858b0c4ec52e4b2f4f87f9955fb7fd3d86cda7feb09f0bc1aa81e6be205a9696d97c5d132e434eb7b57b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786479901, "uuid": "80698fe4-d563-4e66-bd31-a5ed7da628f4", "value": "T152567D07FFA104A4C069DB7289B642227778BC5F8B3573E71DA1AA343F267D12939B14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786479901, "uuid": "dcdba045-5ab7-4861-9ba6-0c899dddbeb3", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786479901, "uuid": "a360e44b-4b40-4626-852f-09809347093b", "value": "49152:NpV0iDmrAklAKFERyosnNMY6fYwlP5rJGmNFOmKeMzjTfdPro+CNyC13IKiae/X3:NnDnNNtp9ijlx9oF8muOyEh+OeH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786479901, "uuid": "1e8cca8a-d6d8-432a-a65e-dad802d8f4eb", "value": 6353768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786479901, "uuid": "844e877b-20eb-402a-a461-54d0778050eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786479901, "uuid": "8553a697-9b42-46a7-a0da-b851cfb0e98a", "value": "56e83d170cfc0d3c9e68ac872ad26e45d0b1686a965cb78d950ad03b551e2b44.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "667aa0e4-95c4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786480619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786480619, "uuid": "0684716c-d2c9-4890-b64f-d1e93686a3a5", "comment": "Malware payload", "value": "15b9c2a53d51d0f0bb73a80bba01c918", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786480619, "uuid": "3a39e267-b3ed-499f-88c5-3fa974279862", "comment": "Malware payload", "value": "5717548bd5b20f9fc8ed9264cf26bb033d640377b23d4ab810d463e61da85215", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786480619, "uuid": "d68daa32-d3c1-4669-8e08-6196a6989040", "comment": "Malware payload", "value": "24e63c7e864078c82d916ccbb02dc68df2cb4df1", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786480619, "uuid": "c96c9c68-eb10-4763-ab8e-8eafff212238", "comment": "Malware payload", "value": "0c4b2ce2ec405325949cd1b4819b170b57ed32000fe6f5366502c5e11126cb142b7eb181626ea05fdcf6bcbfc2cffd29", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786480619, "uuid": "7cff70c9-9fe1-4ff0-9acf-47d8a0d70163", "value": "T127963352A3E31036FB265C76816BA240FC2B74E801EB906D5EF4C62D1771AD68C357FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786480619, "uuid": "d55ec409-0ec4-44b4-a483-170e2e2ee4ac", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786480619, "uuid": "0e9d1f2b-b98e-41ec-a68d-dc914ef5f40c", "value": "196608:qPIK7j65cLiVrB5NmChn93IVpdHCYdv3wtdkgqLxj:ER/iVrBrmC19AEyIcgq9j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786480619, "uuid": "95433fb4-ca21-4bee-a7f1-0ce4a61079d9", "value": 9029829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786480619, "uuid": "51df2958-a88d-47d9-8ae2-4c649f4a16f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786480619, "uuid": "bcfadd79-e7f9-422b-a00f-46e28778baf5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b62cc2d5-9561-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786438232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438232, "uuid": "0ba255ef-cb22-4965-8895-0ff1dfd2c43a", "comment": "Malware payload (AgentTesla)", "value": "93c082b5f85c59045e49e8c0d3576438", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438232, "uuid": "25433e88-7098-4f5b-bbe8-5aceef527a0c", "comment": "Malware payload (AgentTesla)", "value": "5792ed01fc6edfbc82c158c26b183b48b677d6d2ad5af53aea3e412119e79e94", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438232, "uuid": "ff67387d-2bb7-4ce3-b3e9-2e722fb8a1a7", "comment": "Malware payload (AgentTesla)", "value": "2ea5c517673958af833c3c8546dfa3f88c622b2a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438232, "uuid": "5308e2fc-70c2-4382-b2ae-d38c9ac76d25", "comment": "Malware payload (AgentTesla)", "value": "bafefc71b214747e2a3ccd6f2478527253b6df0e39434e160d418b4117dd5bf04c934b6744a5236fb764296b8f41ab8d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438232, "uuid": "6379d405-6199-4804-8437-6dfe8ad88aef", "value": "T158D51A505308AD70A63E672CD137AAE08619211B52C5EF1E31BC3644B7AEF17A79C9F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438232, "uuid": "38940de3-4a64-4122-be12-83ca51399f36", "value": "49152:8abA79bbqItw0e7R73VzDhdVQ05hrgsgpBjIE7q7g77Y09HAVomaq4O87oihXh6r:s7hqItwjN73dD5gsoWE7q7gHY09HAVoI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786438232, "uuid": "6f9c20d6-e23c-436d-984c-4aebcea87466", "value": 3003654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786438232, "uuid": "8f34bcab-891b-4d8b-b004-a757493b5cc3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438232, "uuid": "aff4485c-7851-47e8-b43a-adc3194241d1", "value": "Swift.18 000,00.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ce443dd-955a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786435130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786435130, "uuid": "bb98a528-a3fc-4420-8be6-999c38bfb593", "comment": "Malware payload (Mirai)", "value": "aecfbf5cdc8693d095dedd38999ac0ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786435130, "uuid": "4610bfda-54a7-43d1-800b-fac8ff439eea", "comment": "Malware payload (Mirai)", "value": "57acfe72ef75eb7fec787dff71273397d6b079b60780fad3831a4b3771e4577d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786435130, "uuid": "b056ff92-fb61-4851-95ce-664483a0461d", "comment": "Malware payload (Mirai)", "value": "968e5dd1785f50fbab9d1369806345744af15c34", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786435130, "uuid": "dfae0c7c-8ac6-481e-9a9a-211bda137f45", "comment": "Malware payload (Mirai)", "value": "44dce1d86b20a72e6700f2b1746cd2cc178862d6c3e28cb83ce0531c57daa22e8b7fa9467039032e5e4a180010b507fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786435130, "uuid": "3441eba6-9add-42c2-bd09-45a2286b51c7", "value": "T1CF143A8DBCE9AD31C5C04537FE0F424D37065BDDD1DE7B8ACA384BA2668B41A0D1EA25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786435130, "uuid": "bdd78533-a979-48ca-8d5c-ccf1b8aa7f8e", "value": "3072:ZnCyIXt0Mvsb43jpP9vYl87M5gZlFUGV9sQKquAnNCPrgsVnQlOGd9/7RhxAN:ZnCyIXtrss3jpPNYl87vZlFzKquGCMvo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786435130, "uuid": "54ffdcf5-0257-4add-9488-2b7d44d7a5a9", "value": 191492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786435130, "uuid": "b4a563fc-b0f4-4e7e-8c53-a97ecf2c3970", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786435130, "uuid": "c821da6f-d664-4e8a-a31b-834fa71f0154", "value": "tarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fb6f598-9569-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786441604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441604, "uuid": "f47ea324-8aab-4e23-8981-3aeea946e62c", "comment": "Malware payload", "value": "b6007367933d3408ef03f4aff60764f5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441604, "uuid": "b78d13ec-364b-435e-871a-219f3587dc14", "comment": "Malware payload", "value": "57bf052deb9995511412061106590977a42de7f0f272fa08b9319e4b2a21cf61", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441604, "uuid": "b3748b40-979e-4692-b6d6-e5d9103a3770", "comment": "Malware payload", "value": "c7234f401dd2ef454248a87ab24ab96f3c1e428d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441604, "uuid": "fcd82201-dcc3-4cfc-8934-d9f6176991be", "comment": "Malware payload", "value": "e543607a2a71cb032fbbd7715d27ef494f8166df02f0ae243b8103cd4608e032748970753c39cbc6af1decb58e77151b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441604, "uuid": "713a695b-60ca-4938-bcd2-dec0e1be01ce", "value": "T113415BC910458A382CF2AA6E71E58C98F3E2A1B720C19FD694FB34F7404DE541D82EDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441604, "uuid": "4069358a-f204-448f-a4fd-f91592fd9399", "value": "48:v0djo0sM9T0hdhj80hvw0CGn01r20YgB0c8X0v5M0DVO0SWH0gYz03v35ai:v0djo0sM9T0rN80hvw0CGn01r20YgB06", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786441604, "uuid": "9a290282-66a5-44ad-a3d1-bc9ab5745f4f", "value": 2360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786441604, "uuid": "09f72811-b92f-44e1-83d0-1bcd32cb9343", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441604, "uuid": "53440d3a-255d-4035-8b4a-03f54f461f70", "value": "jaws", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c08a6ca5-95c2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786479911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786479911, "uuid": "c7df7e6c-7db7-4c4f-be6c-4d84d6f2aad1", "comment": "Malware payload (Vidar)", "value": "86e104d724e61c49fe4ab08312cba671", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786479911, "uuid": "4a026aa6-5fb5-40b7-ae8d-a080d3f047f4", "comment": "Malware payload (Vidar)", "value": "5803a0dac6ec415c4f5c3da85ff4d65c517e6243d41f3fe4b58fcdfc6aca5c19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786479911, "uuid": "c2300c76-abb0-429c-ba84-e4442ce926e4", "comment": "Malware payload (Vidar)", "value": "103ba20d2ca6eed0803aea4dc2bc26c6a6aa3a01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786479911, "uuid": "99455ff6-ce41-4261-8aa9-379424a1c907", "comment": "Malware payload (Vidar)", "value": "1ccbc795dc5e926389db204951a87978cae2212d630a7bcf72234ea16803fe6eb4c2f756adfac810c0ba64be5cbf993f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786479911, "uuid": "b0e5e422-a2ed-419e-83ef-873b690f6775", "value": "T15E267A43BC9148FAC0D5A73188B75256BB71BC0C1B3223D32E60ABB82E767D15E76B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786479911, "uuid": "4bfb7a31-daea-40f8-b7c4-4b734ed068cb", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786479911, "uuid": "ff6ae9b2-95c8-4f25-8ca6-3f167d9fcf34", "value": "49152:NISRk/DgAub1G2zfuipJBpYFcwaGWEN0o8sVN4/cw1m:NNxG2HpQcwjbv8Yh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786479911, "uuid": "b61f6383-03e9-48bb-9cbf-89a81d1f04bc", "value": 4524392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786479911, "uuid": "4c3172fc-8a92-403b-aee3-14fa1f62cc81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786479911, "uuid": "70ec834e-b3f4-4a72-ac91-3185513c377d", "value": "5803a0dac6ec415c4f5c3da85ff4d65c517e6243d41f3fe4b58fcdfc6aca5c19.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c84aa5d-95d9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786489702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786489702, "uuid": "db628a76-3f7b-45df-858b-c354f1ca18d2", "comment": "Malware payload", "value": "700e93a3923275f2c5ae212f1567dc95", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786489702, "uuid": "6ef1b9a6-87fe-4a51-a49b-393cbf52519f", "comment": "Malware payload", "value": "587184cfe511eac45445aa470a88a4f5bc1588ca345b8843fcd63082f6dc6da6", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786489702, "uuid": "c654fe9f-6329-4e81-94f6-1cb5e4df6bc8", "comment": "Malware payload", "value": "66d3d36cf0f861b7aecf15f5587d79c821204ebf", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786489702, "uuid": "96b0109f-98c9-46bd-bc9c-44c152ed0287", "comment": "Malware payload", "value": "ca9d9f6b242166ee4988ed4c4d91f58694fc408b728ac1b335c68f12c7ea9a4f95f3265f95c78f8eb2f3bcd5b3a51d1b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786489702, "uuid": "41068824-5fca-431a-8b3c-d12f62cd49e8", "value": "T16A573373996D7F5BE88B4D3504223D128D38DDFC1FF3486434A4BAD974987A6AB8420B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786489702, "uuid": "aec874e7-8469-43a4-8131-de1d316a02aa", "value": "786432:LyVzi5XHOH0P5ctMCutjH5s+98LQi3vmq5oYMEzDy1nG:+VzKXHOH25c2H5s+98jUYMiy1G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786489702, "uuid": "cf2e9456-8d77-4b0e-84e3-9716d94cbc60", "value": 27827860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786489702, "uuid": "d7104550-1b45-44e4-ba4c-7216795292c9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786489702, "uuid": "d5eb0dd0-f245-4bcd-9b54-865d752d7627", "value": "deviceaccess.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38e3fd94-9591-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786458638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458638, "uuid": "842496da-8bf3-4863-9fd3-f8e80d58128f", "comment": "Malware payload (AgentTesla)", "value": "4df78d78b0621e59155b1fddd914c5ae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458638, "uuid": "301f8600-8a88-4013-a10f-3425df212259", "comment": "Malware payload (AgentTesla)", "value": "58f4daa5f56a53d44a132db31580daf6f5e0fa4e093077e772fec23a9205e79d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458638, "uuid": "dc9ad9d4-abac-4239-9258-776845a020fb", "comment": "Malware payload (AgentTesla)", "value": "4cd0fb34a281f86a86fc10e1e593f710d27b106a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458638, "uuid": "4833b537-cb6c-4b97-b244-64b21c35827c", "comment": "Malware payload (AgentTesla)", "value": "718e63e945df34583ca47039f5a828d280c20caa74294e811149f1ac5da6c9708ec1dc8440c77bad1ca5787e79174778", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458638, "uuid": "8482c885-147d-475c-bece-cc820e262a60", "value": "T1E0D27D1132E2C26AE54A8A754ED4C1DB1B20BCA3EE57C20B7385776F183D5E1D473B2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458638, "uuid": "02752383-e131-4bc6-9118-977284e87805", "value": "384:o3fUJDsBSsLwxGDdHeQ3AXxcpJfLCuj3ac2ela2TfERNXaU4:miV3gd+QYAUCTfERBaU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786458638, "uuid": "93373bd8-adbe-418a-a44f-52a2df914c1e", "value": 28672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786458638, "uuid": "6aa62d3e-a14c-4a57-8ea8-099020324bea", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458638, "uuid": "4dd73e15-d740-46c1-b089-6aeb176bcd86", "value": "oc-9786756456879875.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6b94ef8-952c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786415577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786415577, "uuid": "77e35a98-7602-4d90-93aa-9dcbea17c891", "comment": "Malware payload", "value": "ea907a8a939be78ba6581d644cb99598", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786415577, "uuid": "1cf85f9d-146a-4f2a-9c58-eef47c52ee87", "comment": "Malware payload", "value": "5930c7e853dc3db660908caddb5b00cb3da9a3986bd85fb5a0204c28812fd3df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786415577, "uuid": "3018f197-d054-480e-adc9-d2e5aac6faef", "comment": "Malware payload", "value": "6ca0e8e0d8ae4a25db3aef9d247eaff462e35447", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786415577, "uuid": "2e4edc24-a6d4-45d7-b532-0674a977cf4e", "comment": "Malware payload", "value": "bcd9e21fc831e16792bc61ea90efa9be0763900b266d0db733b3a88df367afcb4d05b6a4dbd6eaccef47288a1fdb6068", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786415577, "uuid": "b5915719-a388-4245-b737-32b6c8b11809", "value": "T1AD6329C6D5B4D5AAC060AF37D257FAF6939B7DB484D80B0D5C98FB2B98B17014720E22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786415577, "uuid": "36e5836c-c20b-41fc-8678-2e35027bd0c7", "value": "1536:CzBGKDqOXFfFaKPoYEjLsBFcMdQC+8jR5PREIvryUMnLNWP8rf:CzBGKDbuYE3OckQgDuhpWPU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786415577, "uuid": "a4994489-ae45-48a7-b7b5-ccba3ce752b0", "value": 70712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786415577, "uuid": "0354636f-8f30-4c85-a926-3b070af31cec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786415577, "uuid": "0c186d57-a40c-476f-a24b-17ebd9ca9d38", "value": "main.s390x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e853c557-95ba-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786476541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476541, "uuid": "e3c1ced1-1836-492e-b554-ad1b907e80c5", "comment": "Malware payload (Mirai)", "value": "8c5f788579ba4d76fd2b292112c3dcd3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476541, "uuid": "357388e2-9ad3-4730-b96a-72fd09263ee5", "comment": "Malware payload (Mirai)", "value": "59807a32874118a4232ed71d5dcebef59602104abd3931f0827d31cf48830b2a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476541, "uuid": "96e1a16a-df53-4f14-bb74-80192f510a00", "comment": "Malware payload (Mirai)", "value": "e6c24f89d4f9eea403a88ad5b4fff32781bd44e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476541, "uuid": "d58e7853-0230-43a3-a4cb-20c0449be407", "comment": "Malware payload (Mirai)", "value": "086b2fd370224738e27a95ce64784203a0bf85e4536225304e78e7131952b9614060e5ba54ac5ef54dd6a85018963a80", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476541, "uuid": "41f48785-8a65-4116-804c-8b70e926ab07", "value": "T155C307827E829901C3D0817FAA0E76CD73099397DDDBB7536D621F42A997C27CE1BA01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476541, "uuid": "9e391a11-4ede-423b-9b6c-516bfd93917e", "value": "1536:VUg9z4aU+uPXAuKHDLVhSc9tGgIAFJtSJqYXSMFOFkKGqeT+Tjzu:VUt+UXuhSUGgIAVSkYXt4p6N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786476541, "uuid": "612e79c9-3afa-4236-bba5-0b2426662eae", "value": 121492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786476541, "uuid": "3c40b95c-71b6-48aa-85dd-cc89a2342727", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476541, "uuid": "3503b26a-d948-4e06-94db-f083fec11466", "value": "mirai.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eebdca9-95c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786480230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786480230, "uuid": "340b056e-6d91-49c3-808a-5cc192c1fcac", "comment": "Malware payload (Vidar)", "value": "ceec472b8cb325ad85ebec82b1616d8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786480230, "uuid": "7d76c646-d576-428f-a86f-fedea5aaa234", "comment": "Malware payload (Vidar)", "value": "59b1fc8bd1e78723aa4bb4dc6203373dfc991bfae97eb0560c5868160d1201bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786480230, "uuid": "723b415f-7d80-4551-a2bf-80c08c7ab69d", "comment": "Malware payload (Vidar)", "value": "91b66e44dba4d0f945b644bcfd39dfecd6975684", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786480230, "uuid": "df11cace-8fb5-4ea0-af0f-e57b38e528da", "comment": "Malware payload (Vidar)", "value": "68663351691c3cdd5055f1b6ba9afb87eb92cd95138f46a44f8e16304dd79d8904e4cc98d9c8e7df9440d49554ca9cbe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786480230, "uuid": "0a9cdb2f-f301-418d-9eda-7eaf268eb840", "value": "T1BC068D4B7E9028A8C09A973298F613697B3DBC5D8F3227D72E40B1762E727C15E35B05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786480230, "uuid": "87d752ec-bb14-4880-be3c-53f2e63ee30b", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786480230, "uuid": "a25ee106-2d73-46be-87c0-ca4c907575a4", "value": "98304:pXeIVndSgZWBteDVjuUZr/UJxTZa3WvK1xY:pXFndfZWYs/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786480230, "uuid": "d4f58d90-265a-4cba-b534-4b1026c1a59a", "value": 3800800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786480230, "uuid": "4bb43eeb-0853-4b16-81f0-c7af2515c887", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786480230, "uuid": "8f215a93-d6a8-4171-97e2-74aa0a25bcb9", "value": "59b1fc8bd1e78723aa4bb4dc6203373dfc991bfae97eb0560c5868160d1201bf.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0a7d472-95b4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786473871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786473871, "uuid": "8405243a-4239-4b65-bc90-8122dc998a53", "comment": "Malware payload (Mirai)", "value": "3bc579e2ccc385cec15b6232a119f22a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786473871, "uuid": "515c755c-bc72-4bd6-ad6c-194c15f645cc", "comment": "Malware payload (Mirai)", "value": "5a63a42717135df1c96989bad25f92f7a5b4b9b2d559ae644057ae676715835c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786473871, "uuid": "e54d9ac8-2ff6-47c1-8214-5fb757291504", "comment": "Malware payload (Mirai)", "value": "6a7a0e0cfdca80aeb23aba7cf44d19bef28be72f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786473871, "uuid": "dbc85bc5-0940-4f1a-acb9-baa7107fd91b", "comment": "Malware payload (Mirai)", "value": "ab9b2403e67c71a3150b338c4c2546d36ce9464eb21fa2e076d347eca6ed68037186eb0d2978a7114538c0254fb71536", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786473871, "uuid": "53ddc90c-1af1-4424-85a4-bc4ec5fcfb50", "value": "T1D424C71ABF610EB7D86BCD3701A91B0628CC645722E57F363674D528F90A64F4AD3CB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786473871, "uuid": "251da2f0-68e0-4dd9-b8b5-bde01d627d5a", "value": "3072:OV9ht13oUPiZzIMT4pgKqCGH8dx6/ExgOgmxRBfDVqQO:w9ht13oUPiZzIzpgKqCGAI/CeIBfDVq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786473871, "uuid": "8565bf8e-1a3b-49e3-a5c0-7803501ae8f7", "value": 214920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786473871, "uuid": "03afef15-94f6-43de-86d1-9b2c4f4e8018", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786473871, "uuid": "74f7b60d-aaf8-4308-ab1f-0b404d5a7ffb", "value": "d132e113add4b9ba53e4812c39619b91717a0ba895c311ea002ecd555e34c3cd.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f27665c-9561-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786438167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438167, "uuid": "4ae75278-dfe4-448e-90ce-6a21999357a6", "comment": "Malware payload", "value": "e1067c85147bb571b3d207cbd4e6b7c9", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438167, "uuid": "90908544-10bf-4c70-9e4a-59d40aa8e584", "comment": "Malware payload", "value": "5a7c1eb155e62bbaf93c769834b1ba9e697192694101ea57c9bcf0f1b6f993d0", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438167, "uuid": "8bd33516-4f53-46d2-a633-25bb812e2fa6", "comment": "Malware payload", "value": "ad091ffc569fe09f2e0496cb0c8d86b3aa4d82f7", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438167, "uuid": "f9573681-f65b-4158-8f7a-0d63027d8b4c", "comment": "Malware payload", "value": "d05e0465c5373cf0ca72fa92b26543887ad4908a98a5cebd4809ba9900f8b56e170ef3a2ea487647bbef3aebbceb9f7b", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438167, "uuid": "21587cee-bfde-4dfb-b762-d42647061d94", "value": "T19672443AFA48DFF40B1E11D111C76D022054A796B53A49BDA4DAC5987F3A7108FEB8EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438167, "uuid": "8c749409-eae5-45e0-a245-0deb7e0dad40", "value": "192:6AATiz74mh7wA+1H2+1ibp9cC90hSOM9ammdsYvcC/ZuIr5lUn5+V/TMPXMoj/D:pXR7E1W+1+co0hS2mmdsmuIFTNT2r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786438167, "uuid": "41a24a3d-7c98-44fa-afc8-b8239f24389a", "value": 16188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786438167, "uuid": "e7aa6b18-ceb8-4556-9c07-e46dd46c18e3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438167, "uuid": "666e63e0-f9de-47dc-8ca6-d8b63bcd7912", "value": "DOC_20260810_WA0003.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3ff0fa4-9562-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786438658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438658, "uuid": "fbf156db-225c-4558-839a-d20d6157abe9", "comment": "Malware payload", "value": "749f4cbb313997ecb1e683db443093d4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438658, "uuid": "5224c806-be36-44f9-ad57-50a75f42a178", "comment": "Malware payload", "value": "5ad7ebc6efb7d4152a24c701277b4c360b709130d7e240aa59c0c4afcde5520e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438658, "uuid": "df0847dc-d493-43b1-951a-e53e21ec5f3b", "comment": "Malware payload", "value": "7c7b326e106f4ce561ad66780f5a96fa820ec6aa", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438658, "uuid": "d70a47b3-3302-4a4d-ad28-28186bade53d", "comment": "Malware payload", "value": "7609c470e2af9f1fb00643a190a75ed60a07c2f78928c9802c851b6a671234840da1b4a524d8e0823aae95e3cb98db16", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438658, "uuid": "7f15d330-12a6-4a54-8352-471c3f88a65a", "value": "T1E645B8A1AB51C8E0C6374777A5B82558F73256D7CBC9EACC1358FEF29DA7A103809E04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438658, "uuid": "fe6165a7-718b-4ce0-b121-3c612a26cf3f", "value": "24576:FleYZqS52hOiHAWL/PbOdHqeZDPFqssE0hOQkVQqiIQvQOAGVUlS:k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786438658, "uuid": "fb92db65-f083-43fb-9c42-62170258ddda", "value": 1205133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786438658, "uuid": "c45f2f44-1c32-4dfa-9307-a2fc903b08ff", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438658, "uuid": "3b680a20-78c2-4c90-a54c-7691ecb0060b", "value": "S.O.A 038400271993048 _ 10.11.2026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c537273d-95d8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786489367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786489367, "uuid": "c66e8c95-64ac-4ad8-882b-d3fbb346491c", "comment": "Malware payload (Vidar)", "value": "0f13a4fb899077d5b524af029b78d829", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786489367, "uuid": "8bcda2da-24c4-474a-aa2b-9a72756c2aff", "comment": "Malware payload (Vidar)", "value": "5af71daa79e9277edb5cf0f67dff8163c767af1e4e854e1e7cc4fddabe094654", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786489367, "uuid": "e6c22aea-ed75-46ff-b242-4f482e66f2f8", "comment": "Malware payload (Vidar)", "value": "a12e2fba9f87e4ec7319023c14923065756306b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786489367, "uuid": "71d6d086-10e1-48e3-b142-bada2f581d82", "comment": "Malware payload (Vidar)", "value": "e266c21f51b88fea4b68fca0807fcd0efe6ece45045e518869efaa9e86c4ffffa54e37481628bfaee2eac6b892c59522", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786489367, "uuid": "10443967-a054-4d4f-ab8e-420cc6cf181a", "value": "T1A7666C13E9124D6DC088D73448B5265B7BA8FC6A87357BA71DB2BE372F517E04A32780", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786489367, "uuid": "baa99c72-5ec7-4334-a93e-b060f680c3fa", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786489367, "uuid": "98416d86-ce7b-45f9-8d27-1c921eb10f40", "value": "49152:t0BF+qFPmVAqX/gvhVqR921zheI6EpY9t3y/FICzIrMNwSRwZJ6omf0eMYsuveKQ:t6JVAtEpcsd9qP3hKQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786489367, "uuid": "a1183400-6a03-493d-b904-0e8f07f6e575", "value": 6500288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786489367, "uuid": "9abe488d-f161-4561-b142-116cbe7016f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786489367, "uuid": "fab5a409-1a80-4281-9e4d-a97af88e0490", "value": "5af71daa79e9277edb5cf0f67dff8163c767af1e4e854e1e7cc4fddabe094654.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d15f8d6-959a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786462671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786462671, "uuid": "cb9e2adb-9d7d-4638-8602-4dfc8cebf381", "comment": "Malware payload", "value": "bd6a45301097ebef9d220be1e9a9195f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786462671, "uuid": "22b5e0a1-7a64-4888-9b2d-581a58ae9a00", "comment": "Malware payload", "value": "5b056114964f366df714f9c8f30b8ccac1fccf4c401a2873b83fde884bc9847a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786462671, "uuid": "faff5532-5d40-4d39-be43-053c5478b630", "comment": "Malware payload", "value": "950fa44a65b2ab28865bb5bfbb181bce837c30c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786462671, "uuid": "a84a5da4-6889-4283-b867-b73d54012d7b", "comment": "Malware payload", "value": "7b7658b40e0065b84cd7cdbd466f44ee766c2dd9a6deb9952b7d2851e9ce04b0e04d64c3bc07feace16f4b33ef6ab71d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786462671, "uuid": "5205d99d-d0bb-4b19-93ae-b3425eb1c3c5", "value": "T105054C12FF4C6417C70A06B1A56E5B7CFB52B45341F5C6033B0866AF68D233A1DABE89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786462671, "uuid": "a0d8701d-7345-462f-b3fb-7bb7ce7cb46f", "value": "24576:IphxBvEkuvZTsFisuUb4OMx8fPQr3lb1QERonV8tpqZJIf0lKIMv:IpWkuvZTsFisuUb4OMx8fibQERonetpP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786462671, "uuid": "addfc3d4-7802-42e4-a25e-e0928411931e", "value": 860392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786462671, "uuid": "151504dd-3020-4431-a24c-8d688ed196fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786462671, "uuid": "cde15a1e-5001-4a9e-a468-e080548b739a", "value": "main.e5500", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d901344-955e-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786436822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436822, "uuid": "a47e7836-b014-4390-bb69-73a15b7c2b96", "comment": "Malware payload (RemcosRAT)", "value": "8f8848264a524d19d595b35b661d3f6e", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436822, "uuid": "2d109498-126b-4be2-b10b-3d283579ce64", "comment": "Malware payload (RemcosRAT)", "value": "5b113da04ee992865e5fe6166e9339a4339fb06d1424850870fea5b0e85e6154", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436822, "uuid": "7e703194-bf70-418f-9e7f-8661297fb80d", "comment": "Malware payload (RemcosRAT)", "value": "cad438608720881eb21e9e18a0f31d1db2768f91", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436822, "uuid": "527af2da-2c01-442b-a1c5-ecc3ec85b7e9", "comment": "Malware payload (RemcosRAT)", "value": "06394f79fea305b1eadc6a70dc6f1965f9abf504ada7f3661dd0f5e38bf7550acf9e0d45db57c9ae8025ed6faadae94b", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436822, "uuid": "f1fc626f-8089-4119-b0b6-6c221d0241bd", "value": "T1A172E9B8A4E0E6524F7E31D65BE7380E265A0043D54CBBE73C54BA872EEDDB18B02165", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436822, "uuid": "73ccbb72-579e-46ad-8097-da0e807178a4", "value": "192:lfJH4jgVdirYOJsEibYyKjjSD2qdtqxXr3TefLLdX7zaZnfpvr0Qo6Q:FJH/dsRyzSZefvdX7zCfpvr1Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786436822, "uuid": "3a97317c-3ffc-42e5-9e96-02591fdab6c9", "value": 16265, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786436822, "uuid": "791309df-0828-46c6-85bd-bf2ad87a7b2c", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436822, "uuid": "e50df27d-a011-4bbd-80ac-ead53b398437", "value": "goodthingswithbestnationalwithbestfeelings.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e30d2244-95c3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786480398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786480398, "uuid": "6b467627-ed9c-4011-84e5-2884814498c4", "comment": "Malware payload", "value": "0c8e3425d858df951f0cdf15ffd7b1b5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786480398, "uuid": "9b7392b4-1c97-45e1-94d6-841b7a8329fc", "comment": "Malware payload", "value": "5b5ffac2a3cbda8adbeb1cf0b854f5dc8324d2d585372e3fdada8548cc7c8823", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786480398, "uuid": "333b25e3-53fb-46b2-a650-53f1d4d2629b", "comment": "Malware payload", "value": "14066b6e7ed7c9387cd7c676297f8cfe5ffba298", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786480398, "uuid": "4e5870db-6e49-4a63-944a-f0c25fd369e4", "comment": "Malware payload", "value": "c60f6792ed0704734580cbb8db9061187669064e930bd1a12007f8490aac4809459a71eff2862d498df32771847ec4f2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786480398, "uuid": "164b0e3c-bded-4095-8df4-3270393b7be9", "value": "T162C28D966A867C44BEC98A3E4CBD2B1D6DF4C3D1324942AC3D8A3C719C11F9CC618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786480398, "uuid": "44a4a223-7b5e-4998-aa81-03776e5294d4", "value": "768:k8vCB+25j6es8RF9FYpMSUpi+20qUpi+20YQX:k8l25Jjd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786480398, "uuid": "cd907d79-e3f2-4e53-a25f-1c68f125552e", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786480398, "uuid": "224afd24-673d-4884-b173-635d51eb8ff3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786480398, "uuid": "da57c587-1102-4204-9a8e-ccfc49c3adcb", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0e26e08-9534-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786419003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786419003, "uuid": "9d153602-a466-4100-a2dd-b7f7f99d2617", "comment": "Malware payload", "value": "0c817ec4699b61a76bd8e053bda28489", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786419003, "uuid": "446fbf30-0b37-45ab-9281-5e95e48ae46f", "comment": "Malware payload", "value": "5bc57879f390912a9506f5e457b1eaa8b21858721931e7bdebd5083ec9d5e606", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786419003, "uuid": "06b90ff6-7caf-4202-8709-838ba740d319", "comment": "Malware payload", "value": "0c94e2ca5da885ec68879eb5c5121e0ab1e5d040", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786419003, "uuid": "13d45ddf-3d6c-49aa-8196-b5bac6b6a643", "comment": "Malware payload", "value": "6403a066933e9b613a82144a163125f0a5fb3e00443dd50f5b9fa50981a6ea9773f999bcf6b19c4fc3b9a28af52fb105", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786419003, "uuid": "1ed992f3-88ec-44cb-a85c-0b0354e3e1b2", "value": "T11C3207CCAF9063F4F29703D967AF299D132561CB504CD880F68C6DF0AF4B68D4A56E1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786419003, "uuid": "a625449b-7157-48ff-a2b9-9e70dcf8c7ce", "value": "192:sXHNsGeTHQpD+da6+888+UV7tDoj/pxzsklX42AiYOpzfM75ZHanl9CX:sXX+/DV7k/3XlLAiYOpzET29CX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786419003, "uuid": "b1bcab12-a804-4428-b763-81fa9649bce9", "value": 11912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786419003, "uuid": "138be563-e498-47ea-a667-fe0e25f95f84", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786419003, "uuid": "d63ed715-e6ee-4579-8166-d8ddf678f79d", "value": "fuck_niggers_39.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2438ec8d-957e-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786450443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786450443, "uuid": "6217319b-3303-4ce4-8af6-11d3202768ba", "comment": "Malware payload (RemcosRAT)", "value": "8513107682d18a19b41b2280384f988f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786450443, "uuid": "f8050ba3-c098-4946-b0f8-8490ae899fd3", "comment": "Malware payload (RemcosRAT)", "value": "5bdc1538bbb1e54da444b8f36194936d243c893607886a8a782444700861ecc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786450443, "uuid": "098d7831-844b-4358-9f49-afc0b85e42ac", "comment": "Malware payload (RemcosRAT)", "value": "58e604ba5b365e7b8a505c9d3f3ade2313fa2e94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786450443, "uuid": "468a63c4-6581-44d4-8c07-9cb5fb5776ec", "comment": "Malware payload (RemcosRAT)", "value": "47b0933cb9e15b8fc1631ff063653775baa6a530544d77d49d851dad1452bceb757cc0f67cbb83989b6feab361e31ba8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786450443, "uuid": "6173b51b-2084-4521-8fa3-f420efe6bf31", "value": "T17DB4BF01B6F2C1B2DA7654300935E735CEBC7C21183699AB63D61D5BBD30291DB3ABB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786450443, "uuid": "416d283c-949e-47a2-9bc0-fa54358f373c", "value": "cd443d07fb22cc071cc33eee6cd16e2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786450443, "uuid": "f91f3573-ebd5-4dae-b3fa-f81e07524625", "value": "12288:C97mmDmUefn1CvVkeClYRLwvcHk2c+IsPZOres:ClxDmRnkvVkhYHk2c+DZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786450443, "uuid": "15a1eecc-43d7-477a-a537-bb6cd8bafe32", "value": 525312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786450443, "uuid": "6a0330eb-3a50-4f11-a73f-49ac252b5f0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786450443, "uuid": "f863b7ae-a145-4c12-ad33-b814837a94b6", "value": "SecuriteInfo.com.BackDoor.Remcos.718.1511.31914", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d13dea5c-9585-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1786453739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786453739, "uuid": "d9808a08-2e1b-4f06-97c3-55a8ee123978", "comment": "Malware payload (ValleyRAT)", "value": "db0bfc75dd4b63ea35f103186e35c648", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.wos[dll]", "colour": "#9D8D4E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786453739, "uuid": "d21834f5-c7dc-41b9-815c-eb00fce878bc", "comment": "Malware payload (ValleyRAT)", "value": "5c1c6ec40d70b1e67b864c8a55c7ad9c2384ff4b34fb52ba0509bd31311cd730", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.wos[dll]", "colour": "#9D8D4E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786453739, "uuid": "a14fbed2-c93a-41d6-8626-bd6bc21b989b", "comment": "Malware payload (ValleyRAT)", "value": "462e81afcc42d81d8eb3efe990d73aa8880bdf82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.wos[dll]", "colour": "#9D8D4E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786453739, "uuid": "fc9490b4-208e-479b-8673-95c0255f81dd", "comment": "Malware payload (ValleyRAT)", "value": "765855e3c7a5c9d6b9f61b0dadc840d5b65547bf58f61cf600cdf040065463f0692793e69d187f5d1b402e705e28bb0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.wos[dll]", "colour": "#9D8D4E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786453739, "uuid": "56341d60-7468-4077-b03a-4c04937de0fc", "value": "T19692F71F630394E6C016D5B895FF2B32B5B4BD239DB24F2C6360D6B86F606912B1DE11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786453739, "uuid": "0cec7c56-b0c7-40ec-ae16-7cc9880bf37b", "value": "e2cca75642339e3ecb426e4d7786bbb8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786453739, "uuid": "601b81f1-f0ba-4432-a71a-4503fde84d5d", "value": "384:6o/uyLmKlemekLDB6S1tALwPj8X9Aqp+l5fIiaw:6SuyLrINL/Gqp+9B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786453739, "uuid": "69f8a9c1-a050-4b58-ac51-9168440f702f", "value": 20480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786453739, "uuid": "115e0db2-1ea7-4de8-b731-58f591d8487d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786453739, "uuid": "113b9ba1-f7d0-432f-93fd-5a97d5473dfe", "value": "811.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccaa3dbd-95aa-11f1-bd95-42010a9c0009", "comment": "Malware payload (StealC)", "timestamp": 1786469623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786469623, "uuid": "63a984e8-8225-40fa-87df-cd9aaa4a8e8e", "comment": "Malware payload (StealC)", "value": "8fc11847fe621334f87b6701f5d3c42c", "object_relation": "md5", "Tag": [ { "name": "cloud-flare-authenticator-link", "colour": "#4F01A7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786469623, "uuid": "39423a6d-2755-4c58-87ec-0c928976ba36", "comment": "Malware payload (StealC)", "value": "5c61c977440dd7e870c1a63037558dd3fc2c41c8fd9d6ab67acff1c7d35abe01", "object_relation": "sha256", "Tag": [ { "name": "cloud-flare-authenticator-link", "colour": "#4F01A7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786469623, "uuid": "fb5cb08c-19cd-4610-aa3e-53f49f59d2fd", "comment": "Malware payload (StealC)", "value": "0eecc17726f5a2d520b301125e6ed688f95fb59c", "object_relation": "sha1", "Tag": [ { "name": "cloud-flare-authenticator-link", "colour": "#4F01A7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786469623, "uuid": "1816563e-a9d8-4ac0-99ac-d056934d8d4e", "comment": "Malware payload (StealC)", "value": "76a329bf16b8fe72eed0c8de57009b8a86f9b60747c3e856a339f5b439b3a78b8da9d268c755cecf37c6b53af1cfd7c1", "object_relation": "sha3-384", "Tag": [ { "name": "cloud-flare-authenticator-link", "colour": "#4F01A7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786469623, "uuid": "f9b13a87-0ae2-4745-b20a-f2275de61a9b", "value": "T1276512582719DE06E5624BF81D30E7780BB92D98B920D3078EEA7DEB3C76B1064592D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786469623, "uuid": "8360df3e-ba91-481e-9a97-1f921d215e2e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786469623, "uuid": "07afe919-c3d1-4799-a43b-eb732a1a3d2e", "value": "24576:CRf9+Uss7dO2XrL6VnpM4XCjuP6yP1amNFLOfRT+RUCHdnezgi:CB9+zN2HkpNCyP6yPMz5TOUCHde", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786469623, "uuid": "78f78573-94c0-4058-8a43-2d453b12345d", "value": 1476096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786469623, "uuid": "c1c634fb-b06e-466c-b6cf-3904b0891e19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786469623, "uuid": "fee8d60a-2f2a-4119-8654-e4b9dcecf069", "value": "FLStudio2025_v27_Win.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f775ec8f-951b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786408277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786408277, "uuid": "a07a44df-daff-40ec-8225-c1e753f1cdc1", "comment": "Malware payload", "value": "07593cbef4f9f182fbb501fbc2aa4405", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786408277, "uuid": "d0465c6d-5d57-4cd2-98b4-aea749053ef1", "comment": "Malware payload", "value": "5c76bc92d700c050a7a8126ce43e4ac29db312022cf3ce32717b8f07e26590f5", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786408277, "uuid": "61f4dad7-2a75-4840-a09f-12f1cf209a54", "comment": "Malware payload", "value": "be7f3838ce0c4227e574f43937b0989ef7b58614", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786408277, "uuid": "ab75924e-713c-4c49-91a0-556e198d0cb6", "comment": "Malware payload", "value": "7ae01ae9bb10c7689569ec9dd6d47145292160a25e82002ca357544d18fdf7b6b499800b443319202f203d324205c875", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786408277, "uuid": "2cde7692-c45b-4b68-922f-500472a7613d", "value": "T1B8365A17AA9548FAC0A9D735C4B75256BA70B80D4B3133D71E61BEB82F313D1AE35B80", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786408277, "uuid": "76d96d11-ed6d-4523-ac8d-5631205a76f4", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786408277, "uuid": "dcaa4b3d-bae7-4fa3-9517-38840f52eafb", "value": "49152:ql6Hxd5mvFzBOmbK/JvhHRDQ6hZuWuSRLoClAsBu/0ltxH4Bh:q+iE5Q6HufSR1ucjE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786408277, "uuid": "1c04a3d4-bf79-4bc6-9141-14d258c530fa", "value": 5186408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786408277, "uuid": "cf3b6816-3809-4f9e-a50f-37ea83323cd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786408277, "uuid": "fe3c5b66-6247-418e-ba95-4f99cc14a324", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "780c60fe-95a3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786466475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786466475, "uuid": "32133b5d-6a0a-4578-9652-659eae64c835", "comment": "Malware payload (Mirai)", "value": "a394725fa692e24bbdf45b83da82bd00", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786466475, "uuid": "1e766414-e113-4f7c-ab3d-d0a4b32251f6", "comment": "Malware payload (Mirai)", "value": "5d58f0fa54784e9c90825cba9e2052f691cdcfe85b0796a6379982832563090d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786466475, "uuid": "01fa5f77-18fa-47cd-8a06-daae4127bb84", "comment": "Malware payload (Mirai)", "value": "343a7e7c4390912bd8bf5af4363dbd37c5faa58e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786466475, "uuid": "55ac7049-7caf-4809-bfd8-da6cca02b2c7", "comment": "Malware payload (Mirai)", "value": "69a9e5b8eb7284a7ab0dba20e12eb10d13afb34f29fbb5890adf73d38d29491e9c02f14e25beb6e44d57f1edb1b3d9ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786466475, "uuid": "1ed65140-130e-439f-b169-7cb1d91f166c", "value": "T1F83317332686C5AFD2D753B42AD7D5219823B83D1B33A101BBE87D7E5B26CC42E59306", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786466475, "uuid": "414d4d1e-802a-416b-889d-b5bb0403ef95", "value": "768:RJ5+1xoE+EFhW+sPPd5Q+GkNs+/Z83mISOJw4ccLEPDAuaC:F+1ieFhW+6PA+GGB/ZqSOJwznjaC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786466475, "uuid": "1ade6c16-efa0-485a-9351-b0053f8055c7", "value": 54416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786466475, "uuid": "d7484450-dca6-41fc-bab0-dc95ccad5bbb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786466475, "uuid": "c45d1219-77fc-4d54-a939-c14314c934d0", "value": "123.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca79ccc3-9525-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786412496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786412496, "uuid": "59710b0d-dd71-4fc6-9d4f-3a89ba776fd5", "comment": "Malware payload", "value": "8b7f6e169080d278d59bb30651ca3c2f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786412496, "uuid": "fc936e91-7a80-47cc-8dc6-0fd32dbe4856", "comment": "Malware payload", "value": "5d7b90ad2083eb246eaa32593f29ca0485bf1f743760692df72ccec1103c30aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786412496, "uuid": "d5461dcd-60d2-4a10-b735-028c387a96d5", "comment": "Malware payload", "value": "238f406357b285385b536921e5291ec082e70845", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786412496, "uuid": "03ccd9a3-bb88-4ef9-ab44-5ad766fcd52d", "comment": "Malware payload", "value": "1bd6a2051f34dc6eb8a8a5875bca3d9ac3f8aed07eabaa86e51dcd40301819bd3f7c99261b2c427888a4caa1d4abf3fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786412496, "uuid": "9d2823c6-4ea6-407b-94ef-c40c6dc8d185", "value": "T13F6395563307DA6FF8B917704AF18AB0B3D478E674B05A96E73A7B4C0F300A95D185CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786412496, "uuid": "72fcffbe-ad71-4027-92ca-eee0cfa4c59d", "value": "1536:Qrsa++o8OSX9QDAa3Lt70FZ/NoGv1JB4ou93jpkzbbbrflSjotHHC5pGIPLK5eKE:Qrs6tOS4jNWbr5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786412496, "uuid": "0a04c7af-7fbb-4a8a-b785-a4fdf67a7d84", "value": 67784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786412496, "uuid": "95907f0c-57b5-4fec-b53c-9bffd9b87e92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786412496, "uuid": "25237d8e-261c-4edd-9ebc-14eeaa48997b", "value": "main.mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb70700b-954a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786428470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786428470, "uuid": "c32017d4-37a5-40b1-9e07-0ebee418864f", "comment": "Malware payload (Mirai)", "value": "4ae48550dadd1c0f29973871e761c2fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786428470, "uuid": "6cf1afef-6c11-4476-8ad3-93ced01743f2", "comment": "Malware payload (Mirai)", "value": "5da452c2f33b1f36383a8f9493559c0472d74183549325225291fb736427473a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786428470, "uuid": "817c1eed-a800-4ac0-b6d4-65b26ba9d62a", "comment": "Malware payload (Mirai)", "value": "425cd1e43750f8da9e66fc786a34b57dd9eedc33", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786428470, "uuid": "bee99f4b-215a-44af-9224-e39564cf6780", "comment": "Malware payload (Mirai)", "value": "a4b277ba74ed82d7d9adacfebdd48315cdef2b62308137344ae0d6dcb9b770a4d5d4931f14301986f4c0a44e3623583e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786428470, "uuid": "ac92f8e2-cd0d-4a17-b516-0107fc971381", "value": "T1FEA3A61F2E619FBCF7A9833487F74F349A5823D122D2C584D1ACD6042E6434EA91F7A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786428470, "uuid": "234fc960-bc76-4a44-b6f6-deb34b94cff4", "value": "1536:s14yKSHBczAKZq7tfXZYRoXKQVEKq3H/1WNNimzDTmDtSAfImnIo6X9GQzr:sKZq7tfXZYArTq39+DTGNn8j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786428470, "uuid": "44b3c296-0361-4920-a6f6-8abd7305628c", "value": 103680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786428470, "uuid": "9dc6bd86-4efd-4fae-a8b3-7c83860b60fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786428470, "uuid": "1d96b4be-abd8-445b-b245-c828bb7dc598", "value": "FyTv", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b97e6d35-9562-11f1-bd95-42010a9c0009", "comment": "Malware payload (LxBaseRAT)", "timestamp": 1786438667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438667, "uuid": "579fa12f-04f5-4d41-a482-53e899d9263a", "comment": "Malware payload (LxBaseRAT)", "value": "0c5a937c65e7fdc419204433b027e022", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438667, "uuid": "f75f2a54-b446-4c94-b717-8100c08ba419", "comment": "Malware payload (LxBaseRAT)", "value": "5e5c5aa52216a902351d220ffe5926195853bde23af2369c81c9c4a296d503a4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438667, "uuid": "3c3beba1-3f26-4a9f-a060-0af24e9d5d23", "comment": "Malware payload (LxBaseRAT)", "value": "bfbe500d859e1f768dafdff994012c86fd0d017c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438667, "uuid": "dcef9c9a-6a10-4edc-8d5c-021db749d938", "comment": "Malware payload (LxBaseRAT)", "value": "f2f1a6a48a0e5baa689aed89f60fdd1722be16a046e47ad90bb3553bc2c0ba8e70e418fdd12172ab0f17710ff1f386a2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438667, "uuid": "0096146a-0cb1-4ff9-8b7a-a86bc8e6ccbf", "value": "T152157E845C919A8CB4B99D8E4E5E0288CCFDBE3656708CEB4B7F98C23754D2D25E1D32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438667, "uuid": "9653662b-fd95-4aa1-b38b-428d96c48b8e", "value": "12288:knL3OCE7hj3PlNqCU8aW7HbJ9t+YivcvtHhH71H:PC87UmLbl+Yivc1BBH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786438667, "uuid": "308e8f99-4445-48ff-95c0-76232f270223", "value": 877513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786438667, "uuid": "488d6c21-4240-4b5a-b925-94a2be4c5028", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438667, "uuid": "27d57ba0-f538-4097-a7d5-19120bd54464", "value": "ScannedAttachedProduct.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8f1879c-95bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786478663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786478663, "uuid": "0d929db9-e189-485c-8305-5ea54595d2ad", "comment": "Malware payload (Vidar)", "value": "727ed3b3c569c6f3e21629eccff1c95b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786478663, "uuid": "55871ab0-941d-4793-96fa-9b1419f0f64a", "comment": "Malware payload (Vidar)", "value": "5e825a0650aaf64bd200af14d3431456ea0e844ebf821304bbecc3d3a60f3448", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786478663, "uuid": "1584e525-4cce-4c93-b1e2-e58dea2c0034", "comment": "Malware payload (Vidar)", "value": "f20f950c76c2fc2c6932fe85513b6db3ab5f3b68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786478663, "uuid": "6e692e51-57af-41b1-8621-0599b3e62a8c", "comment": "Malware payload (Vidar)", "value": "a2a7f1651c22bf0728f1f5ebbd940fe78c49b1c3778e4a3abf915a9b7f780503ff7c91bc57bd9ea93855311f60e4863f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786478663, "uuid": "e4aa9319-9318-4b82-b413-00746c4f29a9", "value": "T1B8367B17AE9158FAC1A9E735C8B74245BA607C0D8B3123D32E61BE782F327D16E35B14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786478663, "uuid": "5a1cf7dd-9d6b-4dc1-9bd4-3adb10d09355", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786478663, "uuid": "92f530d4-d644-4198-ab70-a94e0b67b75e", "value": "49152:95I3hEMY8XE0J/nZLgtg6DZMQrThbFHbHcZdN8nW3Su2AukL:9g/Q3hbFHcZdYWp26L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786478663, "uuid": "321cdfeb-fbe7-4c25-b941-f8bb2c85cb07", "value": 5167472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786478663, "uuid": "39f684ef-5474-4ddf-aa5b-22216df8ae13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786478663, "uuid": "5953a12a-d7ff-44de-bca7-9b766e5becb5", "value": "5e825a0650aaf64bd200af14d3431456ea0e844ebf821304bbecc3d3a60f3448.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bdc9a58-9597-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786461220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786461220, "uuid": "216d7d42-8056-4800-8f3f-eb36b31cac54", "comment": "Malware payload (Mirai)", "value": "8c88a321c15bb6124f605581774297ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786461220, "uuid": "0a06a83b-c011-4bbb-aef7-d2d82e819737", "comment": "Malware payload (Mirai)", "value": "5e9cf46fd8f75d168d91248b44ee8ffcdd5d14c2b1c5d985c67a055db64fb72b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786461220, "uuid": "4d66574c-edb2-4828-8a5a-09a1efd8e8e3", "comment": "Malware payload (Mirai)", "value": "319fcff9e4a330eb18f14721a73db6f237ba06d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786461220, "uuid": "e8663f56-5875-4351-97fb-89a315bf56af", "comment": "Malware payload (Mirai)", "value": "d424247c3311c38ea70a7f7cf1be672085d7dda54d67caee9b36018b5b244349f44fc0fb1cc99919c2a0de97354c9498", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786461220, "uuid": "c731687e-f15f-4d57-93b6-7f399e8cb606", "value": "T15434D60E6E224F7DF7A8877447B34A31976923D627E1D584E1ACC2101F6439E642FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786461220, "uuid": "32a93b49-7fbe-47d2-9ff8-21adcd12f854", "value": "3072:MVfjL5WLMJr+1zcLBkaSVWRhkz8ZPh8aMQKmzSRRhkNAwqG:MVfjL5WYdc0peWRKQ1K2KmzCh0AwqG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786461220, "uuid": "9d5bde34-4ec2-4e7a-a516-52f6966033a2", "value": 231232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786461220, "uuid": "0f39ba84-2a81-4f2f-a02f-5d71a2dc055c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786461220, "uuid": "c989043d-2322-40f2-a602-3d5533079d52", "value": "sdfjgnjsdf.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca0bc0a5-9559-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786434829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786434829, "uuid": "428d1b50-6149-409f-8035-da3e79055027", "comment": "Malware payload", "value": "57ba3e7b724f3bdbdd5014311ad6bb0c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786434829, "uuid": "45c3735b-3f06-414c-84f0-570123d88340", "comment": "Malware payload", "value": "5efa7070a281098bb441899fcfda9c2ea9260cd36d1ec42a46013b06cceb4c9b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786434829, "uuid": "0d958436-80ef-4a00-a8d8-f79604fc9e0e", "comment": "Malware payload", "value": "0fbc09f9d085586b173f86d0bc59b8f4b787571b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786434829, "uuid": "76695a16-67ed-4184-a0df-a5a022ae0d2b", "comment": "Malware payload", "value": "3c75972ec77b1d116bb33649d518a4f79db65a9080938be55645559bff83b4cf8bb31397a871b6574a6fd4f46b4aa2a7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786434829, "uuid": "7557cbd0-631f-4115-bd6d-26e0b3719719", "value": "T1A8C27D956A867C44BEC94A3E4CBD2B1D6DF5C3D1224942AC3D8B3C71DC11FACD618B2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786434829, "uuid": "0e903342-fb3c-4631-8f15-e74d5b2f6cc0", "value": "768:l8vCB+25j6es8RTy9FYpMSUpi+20qUpi+20YQX:l8l25JYd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786434829, "uuid": "d53bc13a-07f4-41b1-b1b4-7dda06cf4666", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786434829, "uuid": "d2713979-37a2-4c1c-a188-679b9a5db748", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786434829, "uuid": "f7df0651-4399-4510-9a37-b97acfb1db85", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6efd377-95c2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786479895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786479895, "uuid": "67887a29-df35-4099-953f-ee284e58fd9a", "comment": "Malware payload (Vidar)", "value": "d1873de7dc60ed9d461687e08f8108a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786479895, "uuid": "d948182b-5b69-49d5-b211-aa788e185414", "comment": "Malware payload (Vidar)", "value": "5f4463f48b6fb7f4fd2143db797714780804b5ffa58c7ab9f3a14819045636c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786479895, "uuid": "d0452e60-5162-46ae-a79e-09ccc2a2fc4b", "comment": "Malware payload (Vidar)", "value": "b0efc3b615565c610888da7a999f3fe6995cd8ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786479895, "uuid": "9cded5e6-4fef-4438-8096-87092b2a6ecb", "comment": "Malware payload (Vidar)", "value": "6f6bd0820942bd45fe8d88c49c731f8ff50b7632de7bb5774fee730f990f2902bb023348f2a8e778b74f3f80c2b91524", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786479895, "uuid": "8c3c75c7-ffc2-4dd3-972d-7ce7baf22ea1", "value": "T1CB566B17FF911EB9C1AAEA34C5764212AAA4784C873437E31D60ADB23F367E25935F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786479895, "uuid": "63b24b64-54db-434e-9d49-0ba4795f50d7", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786479895, "uuid": "46c186c2-2f4d-4d6b-87ba-673b10d6537e", "value": "196608:0nnSFMl9qKw/Ze6QIV56yBqrjw1XLf03y:0nSFjBZkIwy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786479895, "uuid": "d2c3cc72-c1a8-4430-9e4a-2501466963ab", "value": 6315752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786479895, "uuid": "732a53e5-5d0d-459b-ad37-572f1ab7c7c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786479895, "uuid": "e85d77bc-6caf-41bf-958b-1a706d14d197", "value": "5f4463f48b6fb7f4fd2143db797714780804b5ffa58c7ab9f3a14819045636c8.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e430f465-95bf-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786478682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786478682, "uuid": "9a76c054-123e-4976-bb61-46f1adef713f", "comment": "Malware payload", "value": "f38fd5deeee0a83f126ed7820cec5a78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786478682, "uuid": "edffecd9-d210-42e9-94b7-31fb4eb61655", "comment": "Malware payload", "value": "5f7887ec3bcbe145c5b3bd21c239f4c96c91d90808bc8ee005829104baa87b4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786478682, "uuid": "3189a562-e0f1-4174-a3d6-1789a711a3a6", "comment": "Malware payload", "value": "43d74958734b66eebe2ad915eb8dddb13e0dd0b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786478682, "uuid": "2a1ec686-931f-4572-ae6c-b42eb80125f0", "comment": "Malware payload", "value": "5cf43d6005d1e2f2cfe00260eaaff04287a2c42bab59f53a549b6b47c72df54032d06efa1ac978f191f38480dd1cd48c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786478682, "uuid": "c23e2068-8ceb-445b-98b7-c50b1dcdf57f", "value": "T1A7366B03EEA548F9D296D73588774242B764BC499B3533D32E60BA742F363D0AE79B40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786478682, "uuid": "7e248350-c445-4180-8c02-1a85842c3263", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786478682, "uuid": "2c3bdc4b-dd72-437a-9aeb-dea4a269269a", "value": "49152:uFKpz7i7FAlc03DCBGcm+a1h6TczyJPj4RRHrYvAaam:uc3XND1aJrCOkm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786478682, "uuid": "f0ac131a-cf1b-4c25-935b-3567f8e02613", "value": 5003301, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786478682, "uuid": "6895a06f-0038-40bc-a464-0023e5df43c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786478682, "uuid": "ecb7cc96-b797-47b0-8109-0b5a6ea0d0fa", "value": "5f7887ec3bcbe145c5b3bd21c239f4c96c91d90808bc8ee005829104baa87b4b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6a72508-95ac-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1786470499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786470499, "uuid": "afd95cee-8f75-4959-a56d-eab22399602b", "comment": "Malware payload (RemusStealer)", "value": "11fbfa1532ebce6b4fe6fbdc9f5f80bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786470499, "uuid": "1c41baec-5934-4ca4-b054-37fe08b916e0", "comment": "Malware payload (RemusStealer)", "value": "5facfcea1185730de6f3cb5b4692d7b9508e5d500f3199b08a737aaad429fbc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786470499, "uuid": "70d7585c-b857-4fc0-9ac4-d1b0bb6cd558", "comment": "Malware payload (RemusStealer)", "value": "92b0077aa6d01fe7f64c03ee0d3e34b586d4d96b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786470499, "uuid": "9c0d565a-af13-4686-bddc-ad38f263dbca", "comment": "Malware payload (RemusStealer)", "value": "741f9c03921fd1e24c7cad5b7d423e11a63a2f07a5a70fb643619b38e118828604ae8c887258916a292d296419b54594", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786470499, "uuid": "c58f468c-a228-482c-b62e-7c773910dddf", "value": "T14FF55B177E9004E9C0AAD731C8AB5651B774BC488B3133E72E94BA782F727D19E35B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786470499, "uuid": "063a2876-9498-4fa0-a837-e46a824a9b35", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786470499, "uuid": "582a2713-757b-4bc0-a70d-35dacab3bdc7", "value": "24576:8VzCLAs0JGuzSUiXJlTw/wY5S7IsWZkwnRHJU+uU/VllfJBele5r920l2fZpfGSR:8Vz+AnJZFsJho+4RpvuU/dV4ZpfrR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786470499, "uuid": "44d112f6-b257-4aed-b283-1bc843ea4144", "value": 3521880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786470499, "uuid": "2fb3b8e9-b2b9-4e3e-8cd4-9bdf02c3f76e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786470499, "uuid": "ec99a2b0-a703-4dfe-b94a-74dd7b4ec3c3", "value": "SETUP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59de0ad4-95ae-11f1-bd95-42010a9c0009", "comment": "Malware payload (LxBaseRAT)", "timestamp": 1786471148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786471148, "uuid": "08127886-8007-4950-8020-2a1f6ea8da24", "comment": "Malware payload (LxBaseRAT)", "value": "ca980ca754a9b4bac92a797c5c915ca5", "object_relation": "md5", "Tag": [ { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786471148, "uuid": "d1d331e2-3abd-4e69-bb65-c215e3155565", "comment": "Malware payload (LxBaseRAT)", "value": "5fdf7a0903d90eacf2a689840cd85fafadb45fd009eec03a64e0c35e0e501af2", "object_relation": "sha256", "Tag": [ { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786471148, "uuid": "b0a0cbe0-0e61-4cd1-84a8-b4d47dbe4944", "comment": "Malware payload (LxBaseRAT)", "value": "140a00a191927e3383962deb5dbe4eafbf3a4404", "object_relation": "sha1", "Tag": [ { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786471148, "uuid": "6475e28f-a16c-46ea-9811-baa11e380065", "comment": "Malware payload (LxBaseRAT)", "value": "2fa9922f876b70ff683f7327f9e788a3f8f705517d550dfe2ec62cb5ca118c1a9c8163f4babcdee38831e3a07a1e0b37", "object_relation": "sha3-384", "Tag": [ { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786471148, "uuid": "7963d548-cce1-4dc9-9b95-bd60af307dad", "value": "T1AA3533FEC227C5EE1ED9310A29B988DF26122EF568D9B1250E15F6F25FF24188507CC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786471148, "uuid": "6315ee55-126d-4220-85e4-ad29f8cd24da", "value": "24576:Gj7fRkkybB2N4iqDDpbMgDEUsexfno0aNhzVvrwBG45ld:qKvbB3DDDpbMcdxftIvUG45ld", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786471148, "uuid": "13bfdaee-da74-412d-a2d4-715b2d39ee6d", "value": 1142466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786471148, "uuid": "8dbafd6b-7cbd-47cb-8411-c8b3128cc88d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786471148, "uuid": "53e22efd-df34-4379-b57b-3b918bb4bed8", "value": "angebotsanfrage_11-aug-2026.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10642669-9560-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786437524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786437524, "uuid": "71b711b2-daf9-41f1-8163-a581e26b4ec3", "comment": "Malware payload", "value": "10d2e74324e8f3b976f149187982814c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786437524, "uuid": "4d79ad29-c046-4b22-9f35-5b25f05a3758", "comment": "Malware payload", "value": "5fff1a131fd063cd416cdf6a630f26b8e6876f3b7c4a7aa72a90745e92af296d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786437524, "uuid": "8c4bbe4e-7a57-4746-9106-327739417427", "comment": "Malware payload", "value": "3dce53dc86b9b21eb0ed55adf7b5dd1434d03351", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786437524, "uuid": "4f09847b-28d7-46aa-a721-8b9d1aa75280", "comment": "Malware payload", "value": "1441bb9cea6139531f82bc1d6dacc75e2a0a93bb39a3142c2ee08c7c008ff58015c3a24a448bb9b331985ece038e6d44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786437524, "uuid": "b0e477d9-fb0c-4710-ae16-59d059ead430", "value": "T1FC0502D2F98166E9E832C57366FBDE1945233C36E68065272358F3262DE3C51DA27E03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786437524, "uuid": "bd60c8ee-fee6-4985-882e-f898ec293c36", "value": "9be4f90f50c714bc00cc8beb2e137299", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786437524, "uuid": "79503622-839d-4317-a06d-0401f1807a29", "value": "12288:/70Znn00dNFHfO49Du4+KT07GTEOJ/zkOLMW7jRym9yRZydWLIMaMYsl4+xD:/7DWHfOPdKQ7GTEOJ/gOLMsgZoRwlTxD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786437524, "uuid": "cf402210-ba09-438b-b37b-6e6ae8354363", "value": 868208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786437524, "uuid": "31141344-b1ed-4bec-8bae-a13c2776c644", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786437524, "uuid": "3793ef94-407e-4184-bcb8-e74e4c268e99", "value": "5fff1a131fd063cd416cdf6a630f26b8e6876f3b7c4a7aa72a90745e92af296d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a35f321e-9549-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1786427893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786427893, "uuid": "0dfb93db-5148-48f8-a7fc-22d04928188d", "comment": "Malware payload (ConnectWise)", "value": "67414e3dd494b33d14f8aacb3781fee0", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786427893, "uuid": "a0e51755-26d1-4a4e-a111-28533112f352", "comment": "Malware payload (ConnectWise)", "value": "601ebaecf6ea1a805b788ca07d202a1e5301f09882a6464ff35203a17020c248", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786427893, "uuid": "8218fde6-b44e-4dc6-9fc8-25cbee2e9dab", "comment": "Malware payload (ConnectWise)", "value": "52671d121bf233dabaf84a5ac7bfa616f3f11706", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786427893, "uuid": "451baf15-1595-4b46-85a3-f7d0c17f3703", "comment": "Malware payload (ConnectWise)", "value": "fa3cbeaecae28cf63538f1fa36d000f1ed1f56c9d1f09b7c18b1732dd280df943719ad101e39868d258095f52a9761ba", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786427893, "uuid": "5d9ee9a7-0be9-4053-86b2-7c37bbf1d712", "value": "T1D846E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786427893, "uuid": "d39824f9-95a7-4f53-ad5c-a55f6bc00cc2", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786427893, "uuid": "e10b7fa1-ec37-43e4-b28b-d5f4397662bb", "value": "98304:0zIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:0hfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786427893, "uuid": "7c9fcc48-9df1-4542-9348-2cd26a523cbf", "value": 5648288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786427893, "uuid": "81743d39-acf4-4927-a5d6-732c3866b47e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786427893, "uuid": "2bb54f3c-23ac-4f79-ba46-1b3925566bcc", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "195ecc85-9562-11f1-bd95-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1786438399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438399, "uuid": "00c42fc0-2678-4094-9fd1-c84ad77d0dbe", "comment": "Malware payload (MassLogger)", "value": "fbecf936bdfb9106544d407b31be70a2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438399, "uuid": "091e943a-e62a-4a2c-a471-64b3ac6f061b", "comment": "Malware payload (MassLogger)", "value": "607fbbac4a3e291dcc525465fa48203e278751fcb4aab9f0af6bca0e2375082f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438399, "uuid": "230d8c46-5840-480c-8ad0-0211f45ceb78", "comment": "Malware payload (MassLogger)", "value": "9de47b28698d9f0cb27195305e998ded03d316e0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438399, "uuid": "9ee43950-f6ed-4853-93e2-176775d8ed08", "comment": "Malware payload (MassLogger)", "value": "bdd391e773d9416e8e660dca65dc41fad99bd08f723a1670efd4a9b222b2837bcc6a9e1160ab3243ee900d9e72dc2e58", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438399, "uuid": "0f8c680e-2a66-4247-bb10-1d42e3bbb249", "value": "T16AF5D9F233CD7A065E5DF384A99D0A8E8F1DD4261E83C7A4F0EF06C0158F465769AA1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438399, "uuid": "70d4b203-70e9-44cd-b889-6547bc73b97c", "value": "24576:UHdPdWj8cM4LGu8t9++LQWdw+wo/BxKvBghjh+aSS7PPYuIGKtoti2qYgUYlg7TB:UxQOwYFFwKsNk/orpjYcGDUkD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786438399, "uuid": "71c76e07-8dca-4686-a526-abd524da8eca", "value": 3480558, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786438399, "uuid": "e48584d0-f188-417b-80a0-783188485e0c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438399, "uuid": "031e080c-0a2b-427d-b624-8f9fb457b086", "value": "IVS NORTH BERWICK.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffc1ad3c-95cb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786483882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786483882, "uuid": "61864fe3-4f3b-43af-bf68-c0e3bd230af9", "comment": "Malware payload", "value": "e398479bd476ef3a5adc95775c01988c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786483882, "uuid": "a31c28bd-928e-427c-95a9-476e30358961", "comment": "Malware payload", "value": "60bcc5fa3895d13bc5b9a5333198a867cf068190560f7b1fb268d526a7c7b8fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786483882, "uuid": "928aa605-5a8b-4934-b1f3-e528543f54bb", "comment": "Malware payload", "value": "e054f1663edb7b3f602c3094ff5ad5e88de2e24f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786483882, "uuid": "7e82f7a1-b8b0-40b5-9296-c1f950c901aa", "comment": "Malware payload", "value": "94d57727acc547adab255be3bb74c4111d087ca8d6aa04bc47c33decea580a55432e0ad3eb4f807e32560f994d48e118", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786483882, "uuid": "b1146eae-e0bb-451a-911b-0e2e11c28a41", "value": "T197667D13BE9255A9C0A5D77085BB8352B738B85C873133E32E21EE78AF227D55E36740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786483882, "uuid": "80a58f24-fa95-4847-9cf2-894686dcdf5c", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786483882, "uuid": "b517f725-69c1-4876-8eb9-246fbfa34717", "value": "49152:zog6YDGFDxUJzU0/4pY7wM4qZyIbcUhSREwLRtmagmmM:zvTi0/4pFYZPhs7P9mM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786483882, "uuid": "13feab40-d204-4a06-8edf-640b8dab7bd8", "value": 6563928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786483882, "uuid": "ffa01706-6713-46de-a5fa-87fd16315eff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786483882, "uuid": "8e91345f-4b7c-4ba0-81f8-22c3424a8b7a", "value": "60bcc5fa3895d13bc5b9a5333198a867cf068190560f7b1fb268d526a7c7b8fd.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18c8f7f9-9526-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786412628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786412628, "uuid": "081dacdb-8628-49bd-973f-9b60e420b43a", "comment": "Malware payload", "value": "a204b987161ee112750cb098a1914d57", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786412628, "uuid": "3b5b1b1b-e1f0-4de1-953b-b7e12db3056f", "comment": "Malware payload", "value": "60c2382b1db5293458a0a40089926a0c8d1fb715703a294085ce3a7cb555ab7f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786412628, "uuid": "67bc4170-2ce3-4828-94bc-fae2328fcff3", "comment": "Malware payload", "value": "1e0ad7d21a115648315c773f6a2f134a7b8776db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786412628, "uuid": "5817753a-9678-4d83-bb74-d99333caf2c0", "comment": "Malware payload", "value": "2078b1d53834885dbe02e4ad2f709160618c98143f5ccc644665dc8b8890abd3a0d4319c0b1860e2435eb4d6357188cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786412628, "uuid": "11cf3efe-c4f3-4223-be14-ad87ccabce4a", "value": "T158466D81FB48A136D98A0E724CB30BA0B7511D45C6E4A91F0705F72F05B26FBA95FEE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786412628, "uuid": "789ad4dd-be58-4d50-83ff-e56d6f167165", "value": "49152:YamTr9OHpxOxLeAnx3RWwLwpyvD5MKQUGt1LaHH4t5E0:40POguxhWwkpGMKCLOn4jE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786412628, "uuid": "244f7540-42ee-4d91-9386-68eb1877fd3e", "value": 5767330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786412628, "uuid": "3a5a9b15-3a3d-45b9-8822-e430ec7aeabf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786412628, "uuid": "67a3cc8d-0db9-4923-8672-5552833a897c", "value": "60c2382b1db5293458a0a40089926a0c8d1fb715703a294085ce3a7cb555ab7f.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "973de25d-9590-11f1-bd95-42010a9c0009", "comment": "Malware payload (PostureStealer)", "timestamp": 1786458367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458367, "uuid": "5e3dcb6a-f3c0-4dca-8da4-8f124a5910a0", "comment": "Malware payload (PostureStealer)", "value": "2ec374bf4100c57cd674d206c1ce41c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PostureStealer", "colour": "#1B7994", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458367, "uuid": "c24c6785-1413-45ba-a0b9-3da27e001337", "comment": "Malware payload (PostureStealer)", "value": "611b49d7d39fe74b6968e2d1e9bd32d5aefe57657b5935bc21af40a8837fb9d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PostureStealer", "colour": "#1B7994", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458367, "uuid": "6eee8b18-0f5b-4f47-8ee2-d1c4e2397ff0", "comment": "Malware payload (PostureStealer)", "value": "ac1b599c4685cdcd2e48ac04b8499bde223d206f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PostureStealer", "colour": "#1B7994", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458367, "uuid": "c21cc9a1-3ad7-4add-a01f-c3462da8b492", "comment": "Malware payload (PostureStealer)", "value": "2b44c2e60d811fcf251d6fea40951a12f16fff3774c4128968139e6eb11bda25fa611668a6f80c23a91cdbdcbd650871", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PostureStealer", "colour": "#1B7994", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458367, "uuid": "2dcb2446-e55b-43a2-8ed7-91e9d9f25706", "value": "T1A4B5AF5AA3B801FDD0BBC274C9075A47D7B2B8461270D79F13E04A9A2F17B716E6E321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458367, "uuid": "41246360-07ac-4cab-9964-a5f7cfb53417", "value": "701bd743787abe222e4516e2b4fb4a7c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458367, "uuid": "9033446d-d1f9-474e-9b76-57feaf1f672e", "value": "49152:cIEe6lxZJG4Pz049A8TE3AebNZTjTcFbAzb3:cvxToZDeEzb3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786458367, "uuid": "6fa03ac4-5f09-4775-a85c-0f718abc1879", "value": 2359296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786458367, "uuid": "769daac6-303e-44d4-a45a-cd6868a7c508", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458367, "uuid": "4efb5e23-081c-4d5b-a3ce-6718f2b5c0da", "value": "611b49d7d39fe74b6968e2d1e9bd32d5aefe57657b5935bc21af40a8837fb9d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9d83a86-95ba-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786476544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476544, "uuid": "acc52bc5-a474-4b3a-833b-7d14600f2efe", "comment": "Malware payload (Mirai)", "value": "723c67be827879ad9f054061859b0bf2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476544, "uuid": "0d7da077-0361-42b2-95b0-efd30b4d5fec", "comment": "Malware payload (Mirai)", "value": "618279e9f6ba7e6765f233e6e86334f7335d219b21d843396af601c4d1ec4bf6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476544, "uuid": "308665e4-a294-4fb2-bb2f-02032eddb5a2", "comment": "Malware payload (Mirai)", "value": "c3b14c824353fe3b055d9bafc66529006ee76bda", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476544, "uuid": "65876bec-4ab6-4d9b-82de-0235be3a6ae3", "comment": "Malware payload (Mirai)", "value": "d83bd3169e989ebf538baa3bfce055a5520d7ae85c02290214aae0551b0bcb37f19fa2d69b0faa58025e415928059206", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476544, "uuid": "ef8f17a3-cc78-4a2e-aa0c-c6335fe78397", "value": "T1B2D3B5DE3A915FD9FE5882308373BAF59344339F1AE6DEC5919CD1440D1024AEA0FA6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476544, "uuid": "6392ec59-0d05-4778-8148-62f40be66f4f", "value": "1536:fDUvHsvHKCHVeuCgvg4FPRceGyLJ/gIAFJtSJqYXFrAy6CPFfpW:rk1MFZceRLJ/gIAVSkYXFrAyhPFfs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786476544, "uuid": "0d429621-dc04-4246-8075-d7851c3ca36c", "value": 137672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786476544, "uuid": "ad7c7749-f335-42aa-8bed-b04255034c11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476544, "uuid": "95841bea-25d2-4718-8bb5-6d520d91486c", "value": "mirai.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4299e5a-955d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786436618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436618, "uuid": "4d4763fb-796f-4fa0-8a31-aaef7aeeaec0", "comment": "Malware payload", "value": "b85cd1ff8953b137a648d47cf9d09bcd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436618, "uuid": "6c117644-5da2-482e-965e-5fdb92cf4d83", "comment": "Malware payload", "value": "6184fcea553e16109281c70eda42abe62178367eefa900205741340d560f5dd5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436618, "uuid": "29d70134-813c-49bc-888f-bbdc77d61203", "comment": "Malware payload", "value": "c21a20559c7795a5bf06d1b0c3d1138f152e2c43", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436618, "uuid": "ba27014f-19f0-455c-ba89-20e94a2decdd", "comment": "Malware payload", "value": "e2e8581e5e88271d8e0e68bc95a133f1a148b70866839d2c48e0f5a5f9157daecc30d9f380aa15198494c47cbb4a2c7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436618, "uuid": "44c78bfc-4ad3-410d-940c-018c8eb62498", "value": "T1E8D52399FCF202B4F472C3B3C697216E72A837504AB48C53768D57106E53529AC7B3BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436618, "uuid": "e9c4073e-abcc-44d4-8b47-df923403ecdd", "value": "1799eb3c1092391ae174afa4eee4cba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436618, "uuid": "64acbd22-15f2-4589-ab64-ba8b02c0edcf", "value": "49152:Liv+uzc9LKgJ7CLPe9MbkALxjNQEI9oSSbxZLjRloJCBswpJ38XQFjBSiCHXUGqs:eGuuLb7CLwMbkojeEKtGh9loJCBswpFI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786436618, "uuid": "e2fb187d-50a6-4f3c-96c8-9a7e2b1baffd", "value": 2957824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786436618, "uuid": "decbcb00-54d8-4461-8b2f-569799595052", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436618, "uuid": "2063974f-661e-4b3d-a93c-ce9604c6e96a", "value": "gM9anpOuZNKX8zHj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2da03cb8-9569-11f1-bd95-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1786441439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441439, "uuid": "5017f4e0-85e2-4140-be59-d4b353a0b37e", "comment": "Malware payload (Gafgyt)", "value": "34618d30ce231a9c9e0bdd50ed3f9161", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441439, "uuid": "e6ff6634-407f-4eeb-8bc5-c1d1ec2e25e2", "comment": "Malware payload (Gafgyt)", "value": "61958a485732d3fb76ef286246047687239f374e873281dfdeddb1538a889958", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441439, "uuid": "817378cf-b7f0-4f6b-acba-3cec4ea220ce", "comment": "Malware payload (Gafgyt)", "value": "a94db9b25eb7337e759d81a4ef6353395b7d6f20", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441439, "uuid": "e5ae1a35-f667-4292-b16d-b407a1bee1c1", "comment": "Malware payload (Gafgyt)", "value": "6833d06781b164ae3a9ef573e7c8dd49d038301a501ac88d773219d0f5d8a35ae1a7a28ec43f830a1ab1c5c653e2366d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441439, "uuid": "d2f9a0bf-bb27-4393-bd15-54d82e66fd04", "value": "T1E0932B46F743C6B3C8431BB10297AA690931F97A0A2E9F4AF31D3CF4AB134D97116B56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441439, "uuid": "a4a8d2ef-c5dc-462a-8bfe-dd4c65420d4c", "value": "1536:MrOiwR1lgnK1qWuMOWJ+a5MZ/0uVMmebDqg1O6RxPmmq+P0Gz+JwLfvKm:MrURcKthOWJN5MRFeLbFBxPmmJP0Gz+y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786441439, "uuid": "cabd54db-48e0-4e56-8663-29103aecaf60", "value": 96605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786441439, "uuid": "59c12b81-73a4-4124-a931-eea7c9c02ffd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441439, "uuid": "4960bd75-38fb-4e2c-9c1f-5fc8a2356fea", "value": "x-3.2-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05464409-95dd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786491193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786491193, "uuid": "d76f44a8-8301-43aa-9a1c-cf18cfa86349", "comment": "Malware payload", "value": "ac1a252c3949e1a81e33e860c28e7cb1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786491193, "uuid": "9ff63fbf-5c00-4dd0-ba2d-e01e6c198c91", "comment": "Malware payload", "value": "61c69356f4bec37a20342bdd6c7359a2dc45e6f98a4d69168adbd35737f351db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786491193, "uuid": "8028643b-1cd1-466c-849b-4722082960ad", "comment": "Malware payload", "value": "080ed17b4843603ec8ac957cba10f6b04b5a54b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786491193, "uuid": "94776aef-9057-4400-b74a-54d94fd79fdc", "comment": "Malware payload", "value": "296559ef80b4a174c0dedbf5d6431cda3c497e3fa26df6b5f1c2ff356b8a3f208160c2cf567252d7cb5fb49b7a0c5252", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786491193, "uuid": "6bc67a95-daca-46a4-a682-e75da30000cd", "value": "T172265B03BE9548FAC095E73189B74652BA74BC4C5B3133E32E60AAB42F763C06D78B55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786491193, "uuid": "fdab3b4c-e609-483f-a4eb-42ed831c9d7b", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786491193, "uuid": "a25926bf-6aa8-4005-9b0c-d5d96a59d0a4", "value": "49152:ZUnSSfFxntMNAuPBQjPgE90cg/xAPv84nZBwR/NAAy+F:ZWVSQjxlGKsuPwR/N2+F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786491193, "uuid": "9d905218-23c5-4a10-887c-6b4cfbe4b0ea", "value": 4719464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786491193, "uuid": "817af3e8-f745-4709-ba8b-7da30b674c95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786491193, "uuid": "b3f27bc3-4eeb-40cc-a678-7435bc52ac26", "value": "61c69356f4bec37a20342bdd6c7359a2dc45e6f98a4d69168adbd35737f351db.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e595ab0-955e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786436769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436769, "uuid": "49e64c4c-9107-49a0-b2a7-cd34ba85817e", "comment": "Malware payload", "value": "39116189e8592fdece92a945c7b56662", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436769, "uuid": "cc35a232-de34-4068-9885-e0c3411efe4d", "comment": "Malware payload", "value": "622727cb6833199773e47b97a994102b20e06a9b59263ac064fa36d3e7e2a98e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436769, "uuid": "113e966f-6327-4e37-a821-1f082d1004cf", "comment": "Malware payload", "value": "55da0d6e55905a0d12b90effabf2568a4581b534", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436769, "uuid": "74ee810c-d494-486e-814d-6f9aa006f986", "comment": "Malware payload", "value": "fb7c4bbd47aa70b6814b76ce54ce9e5b0bb6d212e6dc5dad4d98b43583e7048fb272521745f1517e00a32bffdf188eb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436769, "uuid": "89f1bc46-5bd9-4227-853a-cc1385dd3f14", "value": "T192D523C9FC963AB0E436C3B3469335AD7119B70047718C9E79C99B102D139286DB77AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436769, "uuid": "1ca3fb73-6cf4-43cb-b182-905b2de65e9b", "value": "1799eb3c1092391ae174afa4eee4cba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436769, "uuid": "b39dcab7-c772-4b35-83a7-ba200908ad81", "value": "49152:qRwzJTngQUuNNk+b8PCaQ8mkIRgn8MxkuurW/ONBbHcY4+515e9oeCGGJYgN:qRSeN+N78PCt8mkIRglxOJP7S+5Te9gP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786436769, "uuid": "949029f7-4aad-4639-8d25-9635640fe2bf", "value": 3006464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786436769, "uuid": "d7e3b7f6-f3ed-4d73-9d2b-8954ef307522", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436769, "uuid": "e2a2d8b1-fe06-48f3-b17d-376b06144b1f", "value": "gM9anpOuZNKX8zHj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f774cbb-9527-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1786413149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786413149, "uuid": "443ead7a-af36-41f6-ae63-c25b00c0b176", "comment": "Malware payload (Efimer)", "value": "2cefe539eb25c4730b0af2d05058f695", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786413149, "uuid": "f7e30d7c-b687-43e4-a201-92e12ffd5197", "comment": "Malware payload (Efimer)", "value": "62372c7464bcdfd03129aed0a9aa1d6dd892695f39e3fbb911d88b1d93019f77", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786413149, "uuid": "bd4864c2-dc2f-4b90-993f-208a6d467906", "comment": "Malware payload (Efimer)", "value": "e2c6da60a9a11054dde3b572567c95fd73d044c0", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786413149, "uuid": "265e2a0c-4d61-4957-a5e8-21357426c6af", "comment": "Malware payload (Efimer)", "value": "7a58b5982c58926d7ca5fb0b21931f7e32cd1e55f48f3922c88b40ef952d03a2785bd02e18412b33c55c7a94518593fb", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786413149, "uuid": "c8a7e22f-5542-4f37-b8d0-c91c9002377b", "value": "T153E6330C6AE016EADCA3917DFEC265B1F199F8A61372C5DB87AC07216E531A05C3E713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786413149, "uuid": "c9ea0cbd-f644-4f2a-bdf2-fc4760c2087d", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786413149, "uuid": "f1cacab4-e425-4f59-9b06-d6b5050a2f1c", "value": "393216:WkTUTyaT3RJ3XMkZZaopSrxdGFLnTwC11SD0R0XMCHWUj6cuI3/PGTAI:WkAOaTB5XFZcopSHG5911SYR0XMb83Hm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786413149, "uuid": "9fa4b748-b684-4e45-994c-ca6912dae298", "value": 14026191, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786413149, "uuid": "7c28ec12-9d7a-4c37-8ecc-55462f06a590", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786413149, "uuid": "8c0fac74-b731-4780-8b56-7781306eb7d0", "value": "composer.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e152aad4-95bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786478677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786478677, "uuid": "ebe1d1d0-183c-47ce-b20a-3d18f2aed481", "comment": "Malware payload (Vidar)", "value": "4e063ba02284ccee0bcf0ab78d51a091", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786478677, "uuid": "01486ebf-7eba-4dab-9fee-1c753927cbcd", "comment": "Malware payload (Vidar)", "value": "6257ac218eeb5b1b042d0a4b7beb8f7e347ff897051c078a4540dea82f42cf41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786478677, "uuid": "b6cde25b-f431-4717-ae9c-6269f9291d65", "comment": "Malware payload (Vidar)", "value": "2f49d1d0604a47bade8a2078df3a45512739faee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786478677, "uuid": "169e932b-1e38-4a3c-ba14-b92f6a180d3e", "comment": "Malware payload (Vidar)", "value": "2c5eef573f57c747fb003e8a16b59ab525ce23670a286810d3bba35446fd894e62f9a504e4917b15cc3dc1c7b442790b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786478677, "uuid": "3e29a116-832b-4622-be04-4cf7d990231a", "value": "T136266B03BE9648F5C095E73589B74252BA74BC4C5B3133D32E60AAB82F763C06E79B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786478677, "uuid": "cf40bd87-d2ec-4cd6-af9f-b3dc64fa97c4", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786478677, "uuid": "b5c89891-bee0-4576-9653-125482666379", "value": "49152:+4USz3xtU/u5y4JJAqesDJgPxF0vdlBgg55CX/CAIyc6:+8I4JJusCPxuvdlNHYaGc6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786478677, "uuid": "7f687399-a05e-41c1-b535-a96d4087286c", "value": 4726128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786478677, "uuid": "2a97f57c-ce6f-4bf0-b65d-2192603f879a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786478677, "uuid": "5ff14a3d-e627-4091-8899-83210f8f380a", "value": "6257ac218eeb5b1b042d0a4b7beb8f7e347ff897051c078a4540dea82f42cf41.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "497cc9ac-9588-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786454800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786454800, "uuid": "8a03c462-ed18-440a-934d-fae5987e7b01", "comment": "Malware payload", "value": "ccbb55d87ca1dd884ab7d3609cb560d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786454800, "uuid": "236fbd2d-44d4-4e3a-8728-906d5b44da0b", "comment": "Malware payload", "value": "62f914e09e62bdd18628eb79352ae13ef6a41548065a399a8bd1a51012d66c32", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786454800, "uuid": "d9492747-923f-4887-ae5b-6ab1f2fe2bb1", "comment": "Malware payload", "value": "fdcc9076c3803b7c3f7114faddd0b37a43318243", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786454800, "uuid": "cae95894-c1eb-4127-996e-9ca52d924c8c", "comment": "Malware payload", "value": "2828e1572510b852e7ecb8c924c71c31e3ebb2815ac51e7b098160952057e52722766566161c8446fd34970a623be9ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786454800, "uuid": "a97b2aff-fcbc-4077-9e8f-8047cc5629b0", "value": "T15D53E75BB5E3B0BCC247C0B45A9AD5B1B93178B002213D3FA6C8FA322D35E516659F72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786454800, "uuid": "149d350c-299f-440f-95b2-9d7ef3cf1271", "value": "1536:ThbBD+7+IzAWnbJ7p+cYKTXuvxCupxRUfW2IUr:1BFIzAOJ7plu8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786454800, "uuid": "37e11751-ae54-4561-a064-018931719415", "value": 66640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786454800, "uuid": "e92f8c25-bf7b-4bd4-b2fe-d9f715992e1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786454800, "uuid": "e9d707f2-226d-4b01-bbb8-f51cc41f0137", "value": "main.x86-64-v2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0690e132-958e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786457265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457265, "uuid": "6f094c10-9df2-44f5-a19f-878e97d70d63", "comment": "Malware payload", "value": "da0ea8ad4e33ad7716059530b5398676", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457265, "uuid": "e66b79f8-23ea-4b55-b089-014d8dddf2a2", "comment": "Malware payload", "value": "630d6aa82b5b3ec932f0da8503b1a2e1252a748d7489e49fcef725ddaf8fe37c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457265, "uuid": "36c74d24-562a-4f6e-921c-b8db70e012e9", "comment": "Malware payload", "value": "8495c684c37e6f9a55402697d1bcaad445543b8e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457265, "uuid": "9f59819a-9887-4155-9840-363077c6a675", "comment": "Malware payload", "value": "ec4c3cda103b5fdd69cf3b899dd2b42877dac3af711a0059a279427f03416699c67d3765aedfa424b7329d4c34c87a32", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457265, "uuid": "45bbe16a-9f38-4f4c-bec9-b032227750b4", "value": "T1AAD34B13FB0C0563D8C36EB80E3F0BE683249D5220FED615651D7E6A1B32E719687B99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457265, "uuid": "1416e70a-35d7-439d-9aaf-d4ea7f77dfd4", "value": "3072:pscyiwb6siELWFVUYybrcWASSTQN0p+XtMa5UqM:KJiwtiEqVUYybrcWA81Xt+n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786457265, "uuid": "4ecc4592-7d4d-4348-8c03-d0dadfe0be06", "value": 131984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786457265, "uuid": "51f083d0-b86a-4398-91fb-54c1c0c9ec6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457265, "uuid": "d23c9949-9349-484f-92c5-05169b510625", "value": "main.e300c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8e64729-9562-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786438747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438747, "uuid": "3cf7c7a7-0bac-4ea2-a8db-b20a7e350f96", "comment": "Malware payload (AgentTesla)", "value": "0886955a162928138e959d9a677160f8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438747, "uuid": "4d86d28e-cac1-4b27-8987-e0cea29142d4", "comment": "Malware payload (AgentTesla)", "value": "630fef4a1f9ec20e0e07a2fe8b043845690d14b1af3b13723b544406574a4c5c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438747, "uuid": "0d7e0d34-9281-4dbe-ba76-7dd7e871c292", "comment": "Malware payload (AgentTesla)", "value": "86b6b5e2a4736096e1c4f5b6eaa833cc0e77363f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438747, "uuid": "17609f43-0880-4b65-90ef-f61ad23f90e6", "comment": "Malware payload (AgentTesla)", "value": "71b7e911151e4f8aafbacb7c2f20fc9c1945e69f2df0b39a3c2797268654fec3bc03f0c63d45b3b55c62fec6fcf094a3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438747, "uuid": "048ef73d-cb0c-44e5-a5b8-0a1308b2a66a", "value": "T1C8160AF531A9634E5EA83F09F14E995E1B0FD4609F819BC4B0EE42D4270F46622B8D6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438747, "uuid": "9d61ed9a-4a7d-4b96-b824-5a37a5cb4a99", "value": "24576:Hi6065GT6jdOvIGCeU/aossQtKGd59DSOcAUpl8aNi6065GT6jdOvIGCeU/aossp:Hi606fi606n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786438747, "uuid": "0bfb6463-5809-4f34-8f00-1b79af507055", "value": 4249865, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786438747, "uuid": "2d509789-3e03-48bf-8734-e3b5b25b3a9a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438747, "uuid": "f39f49e1-5f88-463d-886e-a709ee3c4497", "value": "offlinejsiii.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0338e318-95bb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786476587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476587, "uuid": "c413aa9f-3ec1-4e79-9306-9b02de3fcfb1", "comment": "Malware payload (Vidar)", "value": "b93dc1765a554a62cc9bfb6a33d6092e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476587, "uuid": "e271c5ca-9370-4e9c-87e1-84aacdb4faed", "comment": "Malware payload (Vidar)", "value": "6315829b29d7d6a8af37ecabcacd2b0d93903aa24e22b84433d8a19e8891eca4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476587, "uuid": "6db883ca-161f-4f1e-bb2d-f70a5c067700", "comment": "Malware payload (Vidar)", "value": "781d15c31e28224f98411c500a899188eb1b271e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476587, "uuid": "c28e7a1d-9973-4c5c-8aa3-f8550260f0fe", "comment": "Malware payload (Vidar)", "value": "5ebbddc43200f3efcb39ddd547756af9053b9ff9b10bf2099ffd7aed0ce4d962010fc6126dd495547dd5327bd4e4be3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476587, "uuid": "cbd791f1-a8d6-4ff0-8ae1-8c9652318475", "value": "T1FC465B03FE518AB4C096E77489BA52117678788CC73137A72E606EB23F363E19E75B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476587, "uuid": "d1cb6d9d-11fc-4e3c-8331-e607ff871cfa", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476587, "uuid": "ff5d834a-2893-4203-b3e8-35a502bd0db4", "value": "49152:+oc4Vj/pdE0PgQoK7vP6Lk6SsHuQZPeqhgn/URRvBHDyqH6IqkH4o88/NA7NpSmd:+2hnYnaoBOn2bH6OPAppSmATmf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786476587, "uuid": "a3ba1015-b407-40c4-8e53-078c250f73d9", "value": 5356992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786476587, "uuid": "f2c91c0a-9604-440c-a303-ccba4df93023", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476587, "uuid": "647a5506-b445-4b13-a398-48bc1cf505dd", "value": "6315829b29d7d6a8af37ecabcacd2b0d93903aa24e22b84433d8a19e8891eca4.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1665eaef-958e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786457291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457291, "uuid": "550f2a21-f0e1-4f22-b8d1-fa1f493f4651", "comment": "Malware payload (Mirai)", "value": "f455583cdcc352c6cb6a9df9e316389b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457291, "uuid": "d9e39f95-8c0c-468e-b75d-cf2a95d99517", "comment": "Malware payload (Mirai)", "value": "631e2123d08581f52d04f258e9f9b4b60bd649bd8784654b66ffdc37d07125c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457291, "uuid": "aa6bad73-69f2-4924-958f-83bed123f2aa", "comment": "Malware payload (Mirai)", "value": "46c59e0d047176396216475343dfe854c9e7990e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457291, "uuid": "2800f49a-65bb-414a-b485-4f6b2baf1fea", "comment": "Malware payload (Mirai)", "value": "1d098d4979e9775c0dba2773dc75fc4fc53f1ca5041d97555218763f61f0717a204ca012c7d636a904ae27c694571da0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457291, "uuid": "1f147df9-57b0-424b-9145-07405781883b", "value": "T160E41B1AAF500EFBD82FCD3701A91B1635CC695732AA37353534DE14BA5E60A8AD3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457291, "uuid": "ce36b643-c2d9-48a6-b04e-910fa56f516c", "value": "6144:CEsZqYTNPfBFcOESQ/bunj85WvTktUVJxhqV77YqvyQHq3Af762CZ9TYGwPU:CEEcb/bQ85WvTkaJMo4eA+2cTJwP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786457291, "uuid": "02821a6a-fd8e-446b-98f3-0e1c59b34e71", "value": 681800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786457291, "uuid": "c6503cbe-f444-4c80-a0c5-2f38919fcb5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457291, "uuid": "99ad720a-e084-47c1-8503-9b26437f6644", "value": "dmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68c7dea8-9574-11f1-bd95-42010a9c0009", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1786446263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786446263, "uuid": "11af052b-b5fb-43dc-8423-1734fd09baa8", "comment": "Malware payload (SnakeKeylogger)", "value": "787f3727e91a282a890b627b798f3575", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786446263, "uuid": "2395ceeb-ad72-4272-8739-5218581971f0", "comment": "Malware payload (SnakeKeylogger)", "value": "6365b866b8d15f1cdbf6af8fdf79cc0ca75a502fa1e5104d5579ddbde71b0fad", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786446263, "uuid": "bc170b1f-115e-48be-8df2-55e4d44e1084", "comment": "Malware payload (SnakeKeylogger)", "value": "7578e5fc416c959b8022018fc0802349cd62fa14", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786446263, "uuid": "e3200939-c590-41ef-a2e9-43cff3ca4c03", "comment": "Malware payload (SnakeKeylogger)", "value": "2a4b93f32767e824932ab9914ec9ae6ed1650b9aa71c1eca6f041fa9f203b8c56f73af78207362e822988d314b3e8c26", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786446263, "uuid": "7251f778-026c-4c0a-89c4-bb1e39cf20b9", "value": "T1A8733F485983B98493337F7FA22A9894F77A076700994D1B787CB490AFF1C09DEE18B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786446263, "uuid": "478f9f2b-0952-464c-94ca-4b0fd606fc71", "value": "768:fXbbADfjoAkANbllfDhw5ErdLPH12WwKcKaRuGnRcVeKZNr6mhdB4reOwfKUvUFK:zkQA3dCrx1bNYR40JgE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786446263, "uuid": "e68a084f-93f8-43d2-b683-258ed16879e9", "value": 77372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786446263, "uuid": "f77bbcfe-603c-4c20-b91e-1861f6c07b00", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786446263, "uuid": "9d85c37f-a98c-497b-9877-1e9c1190bd57", "value": "SAYAR PROJE MUS RS-YPM-0050-E-MD-0013-00 - MENHOL MALZEME SUNUMU26-07-08-11-37-45.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7113b7d5-9594-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786460021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786460021, "uuid": "a60dca3d-9771-49d0-b9b5-cd769616351e", "comment": "Malware payload (Mirai)", "value": "468a57f019680650f0c6620cc6732b83", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786460021, "uuid": "45405a6f-a101-46c7-a82a-b539a3b2c6fe", "comment": "Malware payload (Mirai)", "value": "637f603f6750b1f51d4bed64ab6cb1cc369cdbb0c0caed371f4169d7816ad667", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786460021, "uuid": "17e07ea9-88e2-4fc5-bc95-1198e14dfb6d", "comment": "Malware payload (Mirai)", "value": "828e4e25580f1e61cf980d9b6c48893eed661233", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786460021, "uuid": "02d50195-0e2f-4583-9951-b144ca668410", "comment": "Malware payload (Mirai)", "value": "a63d8b847a3d5bc307b4c7369ff1afab6de972cfd16386099ccf10933e1af943cfadde07b33576f134d2a2bd1d007b8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786460021, "uuid": "7ec23362-2620-495a-8ee5-26f26904e9c1", "value": "T17033F1F3EEE2C335C665103B11EEBE4974229E26C84560F47E84AA36ED4CF2F5612356", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786460021, "uuid": "ea5783ef-03f2-4c9b-8a75-b1c6cb922ec6", "value": "1536:4mWt248Zyk1cNsMT3H8HkCoNZ4nouy8ryH:4mWt2ZdCsMT3HGkCogoutM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786460021, "uuid": "fe0aac62-4585-4ee2-b20f-042f6ca369ba", "value": 51228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786460021, "uuid": "b7000359-d388-45f9-830f-4e97682076cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786460021, "uuid": "c18bfb76-1f8d-4d20-92e7-6b7743d163b1", "value": "sdfjgnjsdf.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51ebad48-956a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786441929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441929, "uuid": "5ddf64d0-1d74-4d92-8582-710194383e62", "comment": "Malware payload (Mirai)", "value": "b8f6c9bc4824af10ccf9dd5f81106bbf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441929, "uuid": "16ecea01-d95f-4610-bb2a-72f13c2218b7", "comment": "Malware payload (Mirai)", "value": "63806eec660896e1cb28fd8201b14a231551b2102eea22006c6fe3bf662d1bec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441929, "uuid": "e8eabb4e-8caa-45bf-9526-167ec4addfee", "comment": "Malware payload (Mirai)", "value": "07fc94057cf9d61100021e05e39902c65565f454", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441929, "uuid": "a05e5ff2-6e18-4bae-8837-be5c6f3cd2ec", "comment": "Malware payload (Mirai)", "value": "2892c877e7bc02d3f995eaea4c9a33d7d161b8992b9fc6aeea97c729e307e28e5908a80ed54bc8935e7c3062ee4391a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441929, "uuid": "d19a47f2-f0d5-4fbd-97fd-2735e2b139ed", "value": "T1C1730791B8824A2BC2D4237EE9BE618E3360B3E5D2CB7127CD219B2537C551F1D67E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441929, "uuid": "925e8432-b2ad-4e02-acd2-4bb69c89cff3", "value": "1536:4mCSVsiF88YRel8bTcjmYkMpMR3cFdsipaV2lVF6V:KSVsiF88Y+5pFFeYfF6V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786441929, "uuid": "6888c019-1f8a-4711-8986-09d6e04b1dc1", "value": 79932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786441929, "uuid": "08352098-837f-4662-8516-5ec0c3eaf786", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441929, "uuid": "44c908fd-2126-42d6-9add-815bcd8ce3f6", "value": "Mystic.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10aaf198-958e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786457282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457282, "uuid": "820bded8-dd74-4f56-998f-4ea4e60c664e", "comment": "Malware payload", "value": "fecde4ac6d1a4e1b931f05fba346c86f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457282, "uuid": "541c9e3c-443e-4570-8b1f-59e2965eb1c8", "comment": "Malware payload", "value": "63829c58292bd814a4098412f6ff16a70c9f2e6dc343af8f1b2fad9312912544", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457282, "uuid": "76908f84-364c-461c-9618-75607e3d3d37", "comment": "Malware payload", "value": "3043edfb8331cf1aae3ce1f438ce2c408d6da187", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457282, "uuid": "7a003258-424e-4a6f-8601-9362683b7eb3", "comment": "Malware payload", "value": "503c9937e6fa518043f5566924a965e41b5f397643944ddeec12743b06d9bb3dbbddd941f21b5a2fa8fdfe78d0dcc96a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457282, "uuid": "b1fa851f-f82a-4a33-a266-a1f1058f48ab", "value": "T1DD418FC910458A382CF39E7E71E68C58F3A1A0B720C19F8694FB74B7805DE581D82EDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457282, "uuid": "57e87d71-ffb0-4618-adbd-899dab8f5822", "value": "48:v0djN0sM9k0hdhjB0hv10CGI01rj0Ygq0c8Y0v5x0DV70SWo0gYE03v35aB:v0djN0sM9k0rNB0hv10CGI01rj0Ygq0I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786457282, "uuid": "07c8dc68-8add-42bb-9204-e4c7c9ea45af", "value": 2399, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786457282, "uuid": "7e9f479d-1f9c-4d34-941c-34c80833ab88", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457282, "uuid": "b72ffcbf-66b1-4f38-9c44-4b268a595c85", "value": "realtek", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fd0f36a-9573-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786445818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445818, "uuid": "c15abde8-9403-4bbe-80ca-92036c9ce1cf", "comment": "Malware payload (Mirai)", "value": "ac48c33ef3bc1113b9136f28376f0f7d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445818, "uuid": "9b841ffc-4be2-49ba-b9c5-59d47cb5fe4c", "comment": "Malware payload (Mirai)", "value": "640e6ad1c159f02c2e940290113a3d48cf78f33e930217802f13eaa3b62cc384", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445818, "uuid": "7004df42-a65a-4539-bb29-1c9430b63da2", "comment": "Malware payload (Mirai)", "value": "515b259c0fccb8e6b8a8d2dbd0856d395c8ef2c8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445818, "uuid": "e3598c15-f588-451d-ac43-9ce75798a4b1", "comment": "Malware payload (Mirai)", "value": "18b166e4b3e850fef3f49536d73298b6994bb570134a12f7d530921a1b26c03d05f27258bdacc2b530781e92d16aa9e6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445818, "uuid": "a022e5ba-e3a6-44a4-b6d1-50ea448a9db6", "value": "T15633F16BC9F18741ED2C193D59BE750C5902C08D5850D5B89FA0ACB3AD14FA6BF3E722", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445818, "uuid": "c1a871d6-81de-4b33-bc24-fa30cbd3baa0", "value": "1536:RE70VPgz/c3E6Vh0t1ZJEnUOA1znouy8GyM:m70WzyE6Vh0trXOOLouto", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786445818, "uuid": "0ea7dac0-9cd5-45bd-9c66-5a9f5068b5fb", "value": 54956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786445818, "uuid": "ac7fefb0-3785-40c7-be73-7d4ccd96b3b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445818, "uuid": "4d1eee7a-a4db-41e5-9058-3a1e60390cd4", "value": "sdfjgnjsdf.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d19943e-9591-11f1-bd95-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1786458591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458591, "uuid": "0764cbd4-8e3c-4d5b-b1d2-b76db0cde22c", "comment": "Malware payload (MassLogger)", "value": "3d4855f65dbcdfa6d32a14e7dfdb4fec", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458591, "uuid": "0e9b05bf-ba74-4aa1-8f0e-a6a3d77fadc2", "comment": "Malware payload (MassLogger)", "value": "643af499b3cc6dbd379ff60065f66cec4e8d317bca755923ce979cdb4aedbe93", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458591, "uuid": "f2ccee68-bbad-4dfe-b064-ca5b18a46a17", "comment": "Malware payload (MassLogger)", "value": "8b93a192835ea8ad0a0613f3f14cbe569a64bfba", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458591, "uuid": "1db85cf3-aff1-4981-8ab6-3130998e3362", "comment": "Malware payload (MassLogger)", "value": "e043a36c569b377f5575c2ec7f738b87d99d0d39b425f9c5ccdede918b82cdb62ed82cd407f800d727161272f2d2d743", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458591, "uuid": "d48b95bd-2796-42f1-80e7-5b10600f357d", "value": "T12943C3F41B28C0D3ACD9BA54C887DFD4E1787A273CE94E86555087928B1D993FCA1DC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458591, "uuid": "c850210a-f5e2-4788-aff7-07b7845cc804", "value": "768:FslZG5DV8opCpyNKIwL4VgcU3rWTrsPpgkXH19i1IAwonF1NPV+vlio5507fzMBu:bbJVCBKdjpF78g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786458591, "uuid": "7263b316-32ef-42d2-92f1-2c08436389e6", "value": 59670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786458591, "uuid": "6db8d00e-47a4-4cf1-aa2c-5cf28ea2eb74", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458591, "uuid": "e05fc4df-829a-40cf-916e-c20c082b1e7c", "value": "rrk990890.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e863558a-95bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786478689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786478689, "uuid": "e2fb9188-eb84-49c3-b1c7-84dd32987ea6", "comment": "Malware payload (Vidar)", "value": "58bd1f7e59473d791927484344a83209", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786478689, "uuid": "f3efe4a6-d154-46d2-a7f5-5272a4496cd5", "comment": "Malware payload (Vidar)", "value": "6442b93f75c234942d7f9491c587d8e5abc7ca38842a249b61440e0e05973932", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786478689, "uuid": "2a9b5821-d4cf-4534-b7f7-ec3282c9419b", "comment": "Malware payload (Vidar)", "value": "0197e725a84fbe27f23cfa8bce094b84c60c2d81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786478689, "uuid": "7d718d70-0c9b-44d0-911a-1fb9e585032e", "comment": "Malware payload (Vidar)", "value": "7d122e8a49c026c2b95a883f18a148db7d3cd79bcb0867f6e4e10d45730d877381ab3c46366049c7c75216ddc718fcc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786478689, "uuid": "9b3c01d0-0d86-4627-8f50-33f039bb2e9e", "value": "T199267C87BEE16964C4DED231A8BA421A7F7DBC0D8F3223D32D51A6792E323D51935B04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786478689, "uuid": "e83ec6e1-d6ea-4eae-a5f2-8efe473d87cc", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786478689, "uuid": "bf408a99-bedc-4f87-bdfa-e255411559c9", "value": "49152:fxQlY76YoHicJ0aMvLK+XCqCvYZRkaUMvQ3gYNIexxReSdBrze0wc63EP5fcRR6:fBRdLCvaZvQ/Nt/zycdcRR6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786478689, "uuid": "5c5932fd-b776-4597-8673-a92d81853af9", "value": 4758720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786478689, "uuid": "4ca74711-378e-414e-8fb4-a88a2c0fd7a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786478689, "uuid": "de9e5852-2122-4614-bdf6-29c0247ef5c2", "value": "6442b93f75c234942d7f9491c587d8e5abc7ca38842a249b61440e0e05973932.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0465cba-959c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786463616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786463616, "uuid": "a3b2a48e-33a7-4547-a7b7-a95dea0901b2", "comment": "Malware payload", "value": "e0fd7f8c9f79b937ca2b62b51d9153bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786463616, "uuid": "8272ed62-be8a-483f-a92c-2c3d9c338e00", "comment": "Malware payload", "value": "64653d5f524badbce4cdf8d0a8d6562013d2e1aa22a2e5e48bb5ffee9af22ae7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786463616, "uuid": "6b4c328e-498a-40b3-8455-f8b8edf50139", "comment": "Malware payload", "value": "dfdf12349490b251e7687296573a0a6a91b638c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786463616, "uuid": "913ee8d0-adfc-48d2-acce-d68b0804ecbf", "comment": "Malware payload", "value": "05b39bc1f1f4cb93d8b348f7f88cadbf7cda72c2ae9f4358a98cdc900999938159f1123ee3067b8b626b00194abc6afb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786463616, "uuid": "a66242ac-e57f-4468-9f1a-d4b3ef9b6fef", "value": "T1CFD32B06EF447AB7D09E8E3445BFC19204D63CF792D4C33976E86A8D7A7C65906C3A88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786463616, "uuid": "80ca63f4-d06a-4e22-9d46-597b1cfbbebb", "value": "1536:jchqvQZFkGP306umn3got0DWBwfJLXI5PREr:eL/kGP30USwuce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786463616, "uuid": "be8e0eca-bf01-4242-ae67-fd5377bd5900", "value": 140296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786463616, "uuid": "d54b5fb8-2124-4633-bb14-9260ea5ec44e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786463616, "uuid": "1b37ab33-6e92-490e-a975-d240d1c143ff", "value": "64653d5f524badbce4cdf8d0a8d6562013d2e1aa22a2e5e48bb5ffee9af22ae7.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "672aa004-958d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786456997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456997, "uuid": "8a90c3ef-e354-4525-a9b7-5b28a124347c", "comment": "Malware payload", "value": "00db0c234b1780058be90df4f42422bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456997, "uuid": "b4324df7-10c1-422c-9b94-f6d01fdef0a9", "comment": "Malware payload", "value": "64848ac6179f1785b7eb0707b2ab1d9e217f77ac44f409965d2a28a0ebad9789", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456997, "uuid": "05eb6cd8-1618-4248-b030-0ca63d5c8d96", "comment": "Malware payload", "value": "1314c9d69f2f001c017ebf1acf566eaf6e85ef93", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456997, "uuid": "db0aa325-4660-4237-a94c-2ed0171251eb", "comment": "Malware payload", "value": "ecf9bafb13a63f983d80f7c0d0166e82d96aeb48bc3f64d7a985ceb1027fd4101d5f2b65ffa5057edbdba2d11722c2aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786456997, "uuid": "07eeb4e6-d0e0-476b-870a-1c60817cd8cc", "value": "T1AA53D75BB5A3B0BCC287C0B45A9AD5B1B93178B002213D7FA7C4FA322D31E516659F72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786456997, "uuid": "7ceca33e-dcef-4f9d-b239-54ac2d4b9375", "value": "1536:QJxa67liYHAj6oJ7pWoYKTXuvqPuRhKrCmHUrJ:6xaHYHA7J7pvPpcJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786456997, "uuid": "afd37365-64c1-4a99-9e20-afc375bee307", "value": 66640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786456997, "uuid": "7b978424-31ad-485a-94c0-80fde93fb904", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786456997, "uuid": "ffad29e9-f049-4662-bf8c-987d1363a07f", "value": "main.x86-64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a217b3ff-9579-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786448506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448506, "uuid": "e5669589-c243-4b7b-9577-328ff88e8308", "comment": "Malware payload (Vidar)", "value": "b20b3c2ae6012f0b2adb2326dfcb9cbb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448506, "uuid": "19fd3016-a825-4a44-89e6-428a215e371e", "comment": "Malware payload (Vidar)", "value": "648fe5bd71f952abdb8c8d56dd1284942a8a929363b92210ea39dc1c492678ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448506, "uuid": "42552535-c5de-4e03-a35f-4dd75a536d1f", "comment": "Malware payload (Vidar)", "value": "f2b249be64439db362265843a28219d990b1bace", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448506, "uuid": "c5cf5fbc-8d9e-4ca4-b3b2-7da55cb0cc7f", "comment": "Malware payload (Vidar)", "value": "7b3e171d013281436a20d74aeb4ce8cb6a69e437ee7c52007198f5147bd64d5d12a8f9753e3c06764d2a483f89a6d78a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448506, "uuid": "391af624-a51d-4e0c-8559-a221fb785223", "value": "T112F5AE0B6CF008EAC1AB62398CF79152BA73BD014F7723D31994B2392E72AD15D79764", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448506, "uuid": "14b531e4-3ec2-440b-bc04-95b46c29f115", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448506, "uuid": "daaca66c-9cc4-4a84-82bc-2d3f53a41253", "value": "49152:HeMT5k9GKhplVstqR6fs208HqT+b06ZnKLNiXicJFFRGNzj3:HBK7kK7wRGpj3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786448506, "uuid": "79c0d4dc-71ef-427e-b2c2-6a1aab2c6590", "value": 3555328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786448506, "uuid": "b3d4337c-3f9f-43eb-ac00-23aa10b562f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448506, "uuid": "cf7b0bb0-f982-47cf-962b-c54ade839841", "value": "648fe5bd71f952abdb8c8d56dd1284942a8a929363b92210ea39dc1c492678ed.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10e2af18-9559-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786434519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786434519, "uuid": "9af0c9e3-ae38-43cd-b700-912918c9b17a", "comment": "Malware payload", "value": "77437135619e2f8b912a8b60d67feb3d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786434519, "uuid": "0a6a3b61-37ba-4d95-a4b0-daf3f0a6b8ea", "comment": "Malware payload", "value": "650215d97a5138564ba998ae002ab104851241a349046783bd5a844986b412a9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786434519, "uuid": "1a5473cc-b1a5-4c94-a9de-d5ed9352b3ab", "comment": "Malware payload", "value": "f1db9de8e1375f98d6eeb3d7dc6ecf460ea15deb", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786434519, "uuid": "fd5415b8-75d3-4059-9fee-ed87dd1cb1e3", "comment": "Malware payload", "value": "4bf45b830d0385a08cef774b9b98c00fecb3d7c13413b03b18533203655ad6361f4b6c9e14f5f845fb458390250d5264", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786434519, "uuid": "3aae0eb1-a044-4ad0-b119-c3781b8ced14", "value": "T1D7235C6516867C24AE98C4361C7E2F0CB9AD43E6324452EE7FCB3CF68C4A69DD109B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786434519, "uuid": "b3ad3b0d-b58a-4f26-8f11-2b757a7bec97", "value": "768:G+89GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:G+xcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786434519, "uuid": "9696c7fc-9ddf-4a11-b064-4698be0ca5bc", "value": 50071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786434519, "uuid": "63e6b914-f97e-4371-b1fa-31e16478969d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786434519, "uuid": "409cddf0-f869-4448-a131-378d42285f34", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e935b56a-9549-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1786428010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786428010, "uuid": "ea7b9dd6-22f9-4969-8543-f0e00277d9a2", "comment": "Malware payload (XWorm)", "value": "fb99695d5802361a334b204cbbe59689", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786428010, "uuid": "5e293985-1a26-464e-a8f7-40b226e6ae2d", "comment": "Malware payload (XWorm)", "value": "652357261bcf54fb1eb113aac10f24514442ecec668424bbb8a0d52f93fcae48", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786428010, "uuid": "c733cf4e-7349-49d1-8eb9-4869d98154c0", "comment": "Malware payload (XWorm)", "value": "8de6545f4c728eea92dde793a028a0a8c7ae6598", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786428010, "uuid": "34a8768f-1412-4579-a658-b9b0156bd922", "comment": "Malware payload (XWorm)", "value": "7cb04d271c790c72177ce843fe5500e8bfb380d49a1ea0dcc004f61eac559e9708cebbb3f9a31986b58f9c9eda6a8473", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786428010, "uuid": "b84bd78b-1547-496b-af0c-95968687f850", "value": "T16215164F08077888E6A58476C0838BA74530782F559CC39739E703C6697A67F89ADBF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786428010, "uuid": "22f0d72e-09fb-4fab-a9f4-39a0db1827c6", "value": "1536:3xO4vThosoFO9JoszVYyPW666vOkutI1L4ozTolsPFQIwnrbIZD7H0hsom9CaOa8:4h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786428010, "uuid": "a1beda07-5d89-4349-8789-e55d3a431d20", "value": 905949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786428010, "uuid": "2ec0589a-69e0-438e-aca2-5ce357cd0e4c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786428010, "uuid": "fc3425a1-31e0-4d24-a369-30bb28e5dd2b", "value": "rBankDetailsConfirmationandinvoice.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c405d4b3-95d8-11f1-bd95-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1786489365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786489365, "uuid": "1194721b-189c-4365-80e6-a16a58c81e9f", "comment": "Malware payload (RustyStealer)", "value": "949cc4bd6815926f22e70df651fbf3e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786489365, "uuid": "4a5229af-d6ff-4359-b3cb-067ebe2b70ab", "comment": "Malware payload (RustyStealer)", "value": "6525e04eb92332b313f36e123a1606af050dbb416673badfc65e328a21e0676d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786489365, "uuid": "6ba17120-a800-4edf-bee6-8bed0ac95d59", "comment": "Malware payload (RustyStealer)", "value": "9a2275b18ef7e6c636315672c13a0ebd5667f3ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786489365, "uuid": "6af2fa7f-8f65-4afb-8d3f-0e350afe4adb", "comment": "Malware payload (RustyStealer)", "value": "08e3b3beb63805e909bf0f06e948017600bd9346ec708c00037661e53dfae62b5c903f1ca1b617be8fe8701ae962dfc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786489365, "uuid": "dd485905-7f39-4115-b247-9b4c355d3160", "value": "T1AE968C03EA9545F9C0AAD23486679232BA31BC4D5B3173DB2E90EB702F76BD05E39714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786489365, "uuid": "173eb504-c262-495c-87ec-b84c5ae1a7a2", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786489365, "uuid": "f0023e3f-1973-4d48-8950-afea1254b3ff", "value": "98304:wSy72N1c+isla5K0ZctfonjfnjT83v+bR+g9:wvGULn82", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786489365, "uuid": "204254aa-0555-4ae5-8e5a-098df1b8a478", "value": 8853872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786489365, "uuid": "1d62937b-e85a-4c57-8071-b41d6f141596", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786489365, "uuid": "795774b6-8d22-45cb-a3fc-bfe5e68247b1", "value": "6525e04eb92332b313f36e123a1606af050dbb416673badfc65e328a21e0676d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0b03225-9592-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786459376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786459376, "uuid": "88b6adae-b022-45d6-8229-3ceea701268c", "comment": "Malware payload", "value": "3e097545c14c030bf9e58ab3277858ed", "object_relation": "md5", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "minecraft", "colour": "#820CFC", "exportable": true, "hide_tag": false }, { "name": "SemiRat", "colour": "#339CE3", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786459376, "uuid": "266556c7-ebff-4dc2-a6f4-7b0fc17901b7", "comment": "Malware payload", "value": "659fada1cbf0ed66a13bbf11bfc2d7153f10c15c7753c3c9c3579762999cf232", "object_relation": "sha256", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "minecraft", "colour": "#820CFC", "exportable": true, "hide_tag": false }, { "name": "SemiRat", "colour": "#339CE3", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786459376, "uuid": "c650ee22-627f-4f20-a3da-974845d02699", "comment": "Malware payload", "value": "0886e42c683666b5e4b5f3f594e2fef0f9856235", "object_relation": "sha1", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "minecraft", "colour": "#820CFC", "exportable": true, "hide_tag": false }, { "name": "SemiRat", "colour": "#339CE3", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786459376, "uuid": "7687d526-b20c-4f8a-b9b1-d5e182a9cd09", "comment": "Malware payload", "value": "da71d0d14a5a96b2c24a91754c7e9136dadf5b38cdccb00173d692fcb9c822897b6411fad5c93e3a5f02f255105d69b3", "object_relation": "sha3-384", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "minecraft", "colour": "#820CFC", "exportable": true, "hide_tag": false }, { "name": "SemiRat", "colour": "#339CE3", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786459376, "uuid": "0666fc53-5471-4565-ae64-1ea381746cc8", "value": "T12B73125A1B525989C6D224F0CCC5A9956482ABE093CFEE4DE82FED63CB1388513475CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786459376, "uuid": "93e3f27e-0275-4993-b40e-6ebe34dcf519", "value": "1536:hwQTCbKVFvqEB1UL98SN0sAb1H5bvAg8cBoO:hfCyvXTUDQ1HAUz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786459376, "uuid": "bce30ec6-743a-49b3-a9c1-123dfc19817f", "value": 74840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786459376, "uuid": "a348d19b-35eb-43bb-9e52-849c06305f52", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786459376, "uuid": "49f91bd2-c0c9-4581-b2e6-b2ff730a7d91", "value": "mod (1).jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fad94c10-9532-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786418161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786418161, "uuid": "cf17724b-1e38-4b83-b622-2ff5297d755c", "comment": "Malware payload (Mirai)", "value": "fe3ba20e23490cad199a4d2da24fe011", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786418161, "uuid": "f09645d0-1235-44c2-964d-283637642780", "comment": "Malware payload (Mirai)", "value": "6603c2b55fca62b10ec4ea19216ae39fd858b7ee3bf04472e9e2a4a3e5baa6bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786418161, "uuid": "b352d61a-965c-4405-8dd8-9be9bb0ddadc", "comment": "Malware payload (Mirai)", "value": "0121906d17a45e83e4ae32011664ac35f3c2eec8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786418161, "uuid": "b625e86a-87d5-4386-a361-4c8cef720988", "comment": "Malware payload (Mirai)", "value": "2f8503fa3cede701b80f530e6997167ab3be2c466906d6d87845f367a83e76efc14cad116f3808a74f06a5342aad083f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786418161, "uuid": "bc3b6172-5168-4acd-81d8-ec0df9b6341a", "value": "T109C32AA9F890DE52C6C52676FB4E418C33231778C3DA7105CE149E35E7EBD6A0E3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786418161, "uuid": "3b124e18-7eef-4694-836a-f5d55df774c2", "value": "3072:XzwQ+NP5wsYILWTC0vcYEEUpAUWrqORvLLy+XUULKYHlNlEwcf5hf1Dl:XkQy7AfvcYEEUpAUWVNLWCUULXSdBh95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786418161, "uuid": "4371f8ee-1e88-4d60-81a9-4323adf6dfdb", "value": 128464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786418161, "uuid": "25661e19-cc12-4f4f-b5aa-ffa5790cfe41", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786418161, "uuid": "b9785489-1d18-4972-9ca1-d3c9e5a26e41", "value": "putita.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cd7c813-9569-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786441438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441438, "uuid": "1f6f42f6-03e5-463e-972e-5bcdc4f00c75", "comment": "Malware payload (Mirai)", "value": "e72f327d705c2fdfeb2d9860e44b259f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441438, "uuid": "f4ccde89-de70-470a-9022-c505f1e3f20a", "comment": "Malware payload (Mirai)", "value": "661d546af82629fe989abcf66a570e568e69b91feee7509f8aede9f6362b3173", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441438, "uuid": "2bd7e349-e913-4d4f-a55f-580d4a34ae66", "comment": "Malware payload (Mirai)", "value": "9d67727e8948b0726746ec6a065f1b24af4a1bff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441438, "uuid": "44b1b3ef-7dd3-441f-83d2-4791f533a5d8", "comment": "Malware payload (Mirai)", "value": "a66b55e3d33cab242619bfd2c9ba3f0c3e257bc7d7c10ec5fd50f1979a066dbae5a87c566c1054d95de4c1b478391044", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441438, "uuid": "8a25e2c5-1e9b-4930-854a-2a9f76cce868", "value": "T1AB44F80AAF610EFBE8AFDD3712E90B0125CCA54B22A47B357574D518F14E64B1AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441438, "uuid": "05c0ca63-d1d4-489a-bd00-a14f5ad1cb86", "value": "6144:cXg+6e+eVEavlfEQ3XI+SrR4qCwuNx41gh6nTZ9dXlNk:igbHcEavlfDHI+SrRRCwuL2q6ntk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786441438, "uuid": "41bdcbe9-86a0-46d1-9c0a-764922da9a1e", "value": 262484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786441438, "uuid": "32381afb-c513-4d19-a529-ece26275da73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441438, "uuid": "af6fa13f-1976-450b-b458-40532b723cb7", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ee6515a-958e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786457332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457332, "uuid": "93245c92-16f0-4e93-bc75-5e0e3abbf6bf", "comment": "Malware payload", "value": "6b169f8a1f9230466f179cf18ae99886", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457332, "uuid": "04315cd8-8aa1-4482-b53f-46b0f449f52d", "comment": "Malware payload", "value": "664f5181f0094f922b1ae4bfd970516798f8a719ed9e8489adc936d538b90c84", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457332, "uuid": "011534e6-9bc1-416b-a862-b078645f4677", "comment": "Malware payload", "value": "758ed965af5cf6abb6204d22a3580250ab2c5a33", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457332, "uuid": "3908cddb-88ab-42f2-ad14-0f1e0b306b70", "comment": "Malware payload", "value": "f33cbc05b4a95fed060bd2fed71231fb350be8913652dea41b74bbe5c429fee78ff4ebcc3a4fbb6db15bb998424a6822", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457332, "uuid": "6064a86d-e153-4fbe-a767-922015f4b243", "value": "T1E4C153176703DF7EC84F81F847F756359A22BC7D567362857BA5FEA29E98CD02818200", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457332, "uuid": "f09dc161-a8de-4d4e-a4f9-afa5e399fa61", "value": "96:G64UaPTfyn54rjftBmbeApZmjbHOnprgH0:G7Uars4rRoyApabY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786457332, "uuid": "807e2478-7c79-4711-b4e6-b85c951e010e", "value": 5616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786457332, "uuid": "6449c429-dc24-47dd-ba0d-9c6d27dbda6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457332, "uuid": "ba613f89-8724-4afd-a3e1-649de052cdd4", "value": "dlr.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a9f08d1-9527-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786413221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786413221, "uuid": "7be980cb-39af-41ee-a7ac-355c3b79b2cb", "comment": "Malware payload", "value": "2e62f5cd6ea9099a577e5047ff657815", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786413221, "uuid": "a606718e-648e-40ef-8c26-616d417bf5b5", "comment": "Malware payload", "value": "668e88ae20d78da7e3c2bbd7bbcc2d47859dab434d43f8522ea8fafe3d027974", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786413221, "uuid": "d1bb851f-a09a-46c3-a53f-fdc94eae7b62", "comment": "Malware payload", "value": "9871f664834e5274c7817cab8ca08e0ce401d103", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786413221, "uuid": "bf3b1a2b-a72a-4eed-b22a-93ac6a831c1c", "comment": "Malware payload", "value": "a8c96a7ba77b681ca6fd4679f9a29a1101ea2499e44da4b9a952d25143fb40f686fee8ae3dd4eb6ef16cb6e9123cafec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786413221, "uuid": "fa18bedf-2854-4db0-9f64-6d74d3cd0a9a", "value": "T12CD32C45EE456FBBC09ECE34496E809B04942DE592E4832E76ECEDCC7B7D26C4BC2944", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786413221, "uuid": "cf00a39c-a380-414d-ad5d-58a4c7a72b68", "value": "1536:3HXFTnZ/IN1mYkBwzoWwGb1GaLj8VPkt2lwZFtpjfeEr7:4bkBwpn1GK8t4jfjP7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786413221, "uuid": "df97a91d-43de-4d48-adc4-88b860e15543", "value": 140260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786413221, "uuid": "eb489302-c543-453e-a1d6-e2405583500d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786413221, "uuid": "9d8d1e90-f20f-48c1-96d0-8548c1beeef5", "value": "main.mips64el-n32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0931b68-957b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Ladvix)", "timestamp": 1786449416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786449416, "uuid": "52fbd61c-be97-4978-9bd6-dc13194ab44a", "comment": "Malware payload (Ladvix)", "value": "b6eb4d62d72e2609f2fec322abfbf8d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786449416, "uuid": "61e43327-a14d-44a9-a51b-df10c50d4e05", "comment": "Malware payload (Ladvix)", "value": "66cfedb8a0fbf80f79f803e2b7ec815db887298e0b16907a6b358efdf37789c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786449416, "uuid": "8216265a-cf7f-4191-9ce3-aa031fa25ce7", "comment": "Malware payload (Ladvix)", "value": "5c73606f62a842452d973f967418838e9c7ebc42", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786449416, "uuid": "4337d2ec-4aa4-48ca-b5cb-0fe37040f8ba", "comment": "Malware payload (Ladvix)", "value": "368c28ceea9cd8e4f6d2f3ca03e90be37a7efb78c242493df5ac5e30597d5660af48052f473be534eb047c3e658e2102", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786449416, "uuid": "12deda0f-a566-4896-a6b0-f5cdf20baba3", "value": "T194C57B177CE118AAC0AA92328AB2A692BB71FC490B3123D73F50B37C2F767D45975744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786449416, "uuid": "405e616e-12f3-402b-849a-82936322242c", "value": "49152:uhAPIoHwyHKx+pF/lHDYAMHajKBDPbAJeIz:uEX/lHDdODPbAJ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786449416, "uuid": "fd7a687e-7606-4e96-ab36-4753d7f1ff62", "value": 2665097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786449416, "uuid": "c638a2ba-3471-4116-b71f-5ce1d3f4819e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786449416, "uuid": "db24834b-8ef0-48c4-8eb5-e33f0696217c", "value": "main", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4054978c-958e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786457362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457362, "uuid": "f6de2e0c-970a-4c7f-9831-3e60cda45bd2", "comment": "Malware payload", "value": "366232c67cbf117372bf09e89e4eed46", "object_relation": "md5", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457362, "uuid": "7cc2519c-68bd-4b0d-9993-8fdfe861f2ec", "comment": "Malware payload", "value": "66d80fc6616a1873259ce2e6ab41492cb60ff1d68b576427738d62eaf0d085fb", "object_relation": "sha256", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457362, "uuid": "20005951-e98a-4f6c-ac5f-ce4ad9efaef1", "comment": "Malware payload", "value": "cf0487ea67e2f93999680271afa62e32b974079b", "object_relation": "sha1", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457362, "uuid": "3d19793b-7d30-458d-9339-262da218982a", "comment": "Malware payload", "value": "188091b07d3d2fe60c5e1ebb2ad074dc85201795d03be33339f1119f90d52e6b975575c2dd2b3569fb2a54cd06a76692", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457362, "uuid": "488dc5b1-421f-42b5-af31-b1fef1b53027", "value": "T168B51929C3D2F0A0C9F45EB691A8A891051377DAD79B3297B90F2CC1771F39B647C81A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457362, "uuid": "cceab8c0-b2fa-4df3-8c54-02a2ecf3faf9", "value": "654afaf5cf09f43cb91d77b86c705779", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457362, "uuid": "84521d90-3b4b-4807-88ad-bf2f1ce99260", "value": "24576:8cbwoGDu8UhPlZoV/KSGaD+sKv9eq7HnnGM/Xt:8cGC86P8V/62WLHjd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786457362, "uuid": "b1dc9505-e8ac-441f-8480-2346cff490b1", "value": 2492368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786457362, "uuid": "a4972280-294d-484c-ab61-d805a545bf5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457362, "uuid": "fe415aa0-b97c-4747-80ab-36fdd2238a40", "value": "Set-up 2026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "090259f0-958e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786457269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457269, "uuid": "813763e6-bab0-4116-a271-40c8805558cd", "comment": "Malware payload", "value": "5f5d3a478d5f02ce2652800abc79f8a2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457269, "uuid": "bb605186-2815-44bd-a49a-41982a821d42", "comment": "Malware payload", "value": "66ecff248a0357c85ebc56f69cf664ddc6d856a37442370180fb704b970f65f8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457269, "uuid": "f24a400d-561a-4a48-90b7-773ab3e6e95a", "comment": "Malware payload", "value": "f2c8d69362b7578873e61b68da91d2911b1b2617", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457269, "uuid": "f69a0768-4c8c-4e82-9245-1eb3437ee6aa", "comment": "Malware payload", "value": "dd1b3beca71c3de09043335ce32dad298feb1521e861a70fa877a34aa95d1ea626005a68ae921020f711458ba4e454bc", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457269, "uuid": "b3f8744a-52b0-4745-b9fa-c4f35f050ace", "value": "T1EC4186C900454A392CF69E6E31E64C98F3A1A0B720C19FD6D4F734B7404DE452D86EDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457269, "uuid": "714b66e5-957c-4458-b5dc-150757a89978", "value": "48:v0djG0sM990hdhj60hv+0CGB01r80Ygj0c8x0v5K0DVE0SWh0gYd03v35aM:v0djG0sM990rN60hv+0CGB01r80Ygj06", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786457269, "uuid": "0065287c-72d2-47dd-a634-376d2c3664ca", "value": 2386, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786457269, "uuid": "c5803389-76d9-4e42-bdfd-503a82fcdb1e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457269, "uuid": "61ad4b01-4b3c-445c-b5d8-50dddb3e1b03", "value": "huawei", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "670da577-95a2-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786466017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786466017, "uuid": "469f9909-dd66-4603-98bb-139ee9fb6e15", "comment": "Malware payload", "value": "469e277d37d319f54b9165f2792b0182", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786466017, "uuid": "f8652c60-eb38-4393-9cd2-04b195fd4fd2", "comment": "Malware payload", "value": "67068a0f320567ed876255f725212e2a8b583f351d621fe2ccd8423a3512dde3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786466017, "uuid": "b0b10a0e-2e33-48f8-aed2-c4ca26e8061d", "comment": "Malware payload", "value": "0c483c9647885ff7630275646ca97c3948082bab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786466017, "uuid": "f38d6b23-76ee-41cb-9c27-bc5a25dc7e1c", "comment": "Malware payload", "value": "caa355392092091a9c48576b5b815c901af8e58840cdf64c3a19077ddd6f88e8fea54e7a772febd6172736ce28f447e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786466017, "uuid": "aabaf4d8-be77-4dfd-972a-3caa9061bdc8", "value": "T1E653E85BB5E7B0BCC287C0746A9AD5B2B93178B002213D3FA7C8FA312935D512659F72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786466017, "uuid": "5e8d65d1-dcef-41b2-af8e-fe39e8b709bf", "value": "1536:jm+TcwzUAKteAZ7Lp7xLzvzDTXpvByORBmZrC+UrJ:vTKAKteAVp7xL/yL4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786466017, "uuid": "22dddce3-b7c6-48ed-9d71-e648b65ac4fe", "value": 66640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786466017, "uuid": "e955171b-cb20-4a3d-b649-ba3a111a7245", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786466017, "uuid": "1819e590-6c5c-47af-ac58-b52faed7f91c", "value": "67068a0f320567ed876255f725212e2a8b583f351d621fe2ccd8423a3512dde3.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e027e0a3-95bc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786477387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477387, "uuid": "b69a5a68-1c5e-40d6-9758-602ee0538eda", "comment": "Malware payload", "value": "f316a96b45e5f61585531cd26143f04b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477387, "uuid": "cbbfecc3-8c96-45b3-bd1f-8d218f4bfae2", "comment": "Malware payload", "value": "67179bc5c4c609e19c918af6b68b38ae09254b203f97834fd36811f539370e6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477387, "uuid": "f89f5269-cc2c-4a3c-9013-9719101a4a14", "comment": "Malware payload", "value": "755f0daf53bbf5c25efea6114f783303afe655f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477387, "uuid": "d9ee79f1-4bc1-4d57-b770-c6293db67b75", "comment": "Malware payload", "value": "c7307b84a328f6fd0d5f7d0680e3e8eea4a8144cc95ae1c8f7bf981fdbe10e5fcae9ff8c1039503054cea2609d7e5438", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786477387, "uuid": "e519142b-a81a-4f20-bdb2-46e211ac9313", "value": "T135366B03EEA548F9D296D73588774242B764BC499B3533D32E60BA742F363D0AE79B40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786477387, "uuid": "3fe6c5d7-d4ae-4413-a38f-83794fe47218", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786477387, "uuid": "c7ffce9b-4fac-4956-8f47-0cdf32085971", "value": "49152:uFKpz7i7FAlc03DCBGcm+a1h6TczyJPj4RRHrYvAaaW:uc3XND1aJrCOkW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786477387, "uuid": "f348e94c-264f-4479-9cf7-113ddf16d165", "value": 5002435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786477387, "uuid": "0a1fa753-5116-4bce-b033-9334bb06a1c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786477387, "uuid": "1b377163-c9bc-45fe-94bf-1492554bda30", "value": "67179bc5c4c609e19c918af6b68b38ae09254b203f97834fd36811f539370e6f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ba629d6-9526-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786412686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786412686, "uuid": "730ec8e0-c271-4bc4-ac61-9738628d0710", "comment": "Malware payload", "value": "1848a10d73fe21860eec88c6369a17d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786412686, "uuid": "9d10359a-15dd-4891-bee3-9dbaa217c227", "comment": "Malware payload", "value": "672de551af096192ece9e57ee4727d2dd48b81957a4f61373aae955ae3442def", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786412686, "uuid": "67cce991-959d-4f7e-aed3-fc1b26ca8d5c", "comment": "Malware payload", "value": "45892520001f287c23d3df857a40862b8f08b4b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786412686, "uuid": "c3febdd0-6434-49b8-a0b6-56d603bd9b3a", "comment": "Malware payload", "value": "d352f9da5b5c3a1697cbbaebf011bcd5aea9d4355fa8a238d508dae23681d5c05779155b9a7401e91f5dd1c597309456", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786412686, "uuid": "03358a51-b42c-4e5c-b4f5-44b2ab9420f7", "value": "T149D33A51DF0C6C2AC9712AB595F727A4B79078D12134CA3137053B2F1AB7236AC8BF99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786412686, "uuid": "76b1ad7f-62df-4f91-9a60-9c997de41b80", "value": "3072:Gyf4MvkiK3BBFABwEnNyfFbUSuvnqqLGvpyuBHA0:GyobAZ0NbLuvqKu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786412686, "uuid": "69525feb-3c40-480b-86bb-fad8b861e5af", "value": 132248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786412686, "uuid": "099af764-4075-412c-b244-37b3d71f6e77", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786412686, "uuid": "3feba2ce-6c64-4512-8279-8009779c517a", "value": "main.power8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "967b586f-95de-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786491866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786491866, "uuid": "317e5b08-67c0-4247-bd15-c553ee18c390", "comment": "Malware payload (Mirai)", "value": "3f2eb89ae75d721ec7fa7ab570e36383", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786491866, "uuid": "d9c07916-f7ee-4ca1-8f0a-256c80347f74", "comment": "Malware payload (Mirai)", "value": "6754b6bc55c6843c6730d1204d4fd442e2f040e89d9fb7e2084555aa8f9249f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786491866, "uuid": "c1ff27a2-559b-4dc0-a8fc-0363a548b445", "comment": "Malware payload (Mirai)", "value": "e764f3f72251df32414244adc3b10e27db13baa7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786491866, "uuid": "67441e8e-827d-4905-8274-4b0bafa3f517", "comment": "Malware payload (Mirai)", "value": "c0ef8ef6f931e63938ee5e1afe880b64689e8cab3e670e1db5cf33d759adaa771cdc781b1052aca0c57a04ed40e09215", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786491866, "uuid": "94474f29-d051-49c5-825a-2f02c8727c76", "value": "T1C2D312A615684E82E9CEF17C26FA431A59739F1AD09AE482C3C662F3C0E31D17F6D1C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786491866, "uuid": "4f66d98b-2c32-4fbb-89f2-e12146b4bad7", "value": "3072:wMmHz6VsLGABy6KWDVVwOpow3L4THc70Ox52uFDqYRgUNu3V+:wMmOVuTKWV68vAob52u1q2cF+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786491866, "uuid": "0cb99f66-2bbc-4448-b110-68000cc4ae57", "value": 132728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786491866, "uuid": "3f0b5f3b-899b-4833-81a0-744d1e26f381", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786491866, "uuid": "b44c2dbe-b483-4874-b5e4-e9c453aad835", "value": "6754b6bc55c6843c6730d1204d4fd442e2f040e89d9fb7e2084555aa8f9249f4.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ea277ba-959a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786462674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786462674, "uuid": "971ac263-2843-4765-becc-8cc8653fafb3", "comment": "Malware payload", "value": "9139bcd07c3e2277a17f1e0f252cbcad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786462674, "uuid": "3fa2bcf5-1009-4d0e-a62a-2a544c2eedae", "comment": "Malware payload", "value": "67a4109bc91f88723177955cf327e4ad6e75897e57c6e681493a00cb5e89818d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786462674, "uuid": "679508ff-bf14-4712-b8db-3dc65e1a6b00", "comment": "Malware payload", "value": "688a1cd6ccabf3f8af66d5bc143fd96117c98a0a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786462674, "uuid": "3dc30625-d455-408f-ac1d-7a1507ddd468", "comment": "Malware payload", "value": "fb273417acf719f525a98574962ae1557556e588d5c1d9e462bf674f12926a539050fbef5e378f3a809c63d70b734bfb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786462674, "uuid": "c12596ae-8e14-49c8-aedb-fe98a673e9e8", "value": "T12B637DA5EE0E7841E2C5E375EB5A0BE1B12F38A0D36644B77901B18DC0EDADDCED2205", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786462674, "uuid": "67737631-fd2e-4798-a249-a53a9389ade3", "value": "1536:rizG9dekBnwafZQ+xqCxobrh1KM1Z/NZQgL9MwcrZ:e+xwuZQ+xqCxehTnQgL9Mw0Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786462674, "uuid": "6e350859-0e17-41d1-941e-c3cca349c993", "value": 70720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786462674, "uuid": "73d2e879-3fc5-499b-ac27-115ca379301c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786462674, "uuid": "50259ec8-69ac-4086-b143-af28d0323237", "value": "main.aarch64be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3447ecec-9590-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1786458201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458201, "uuid": "e4261da9-9fe8-477f-9bf8-229b22cee756", "comment": "Malware payload (RemusStealer)", "value": "4c7fb4793eb3893b314304b7d6dd4455", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458201, "uuid": "7380e9a1-45a1-4de6-a0f7-0354d0c4221c", "comment": "Malware payload (RemusStealer)", "value": "67cf306a6ce1e508b84198b092adf819d8dc00da9ff4e6c9be24a78a386da130", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458201, "uuid": "3f1c1b3a-c335-468a-ace6-5462dc16d706", "comment": "Malware payload (RemusStealer)", "value": "29a11378ffc460f5c7429df11773f2f08b32e211", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458201, "uuid": "ec52ff94-1c6d-42e0-8c6c-f72e99e9efc7", "comment": "Malware payload (RemusStealer)", "value": "b12810c933d540e8c879de53091b65c01b5276e762f01a5ebab198cb58df449cd22d5f0cb0d987e09aa50f9604d89982", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458201, "uuid": "8c43054c-05e3-4988-afb7-a592fe55d6ad", "value": "T1D4D55B077E9048E5D4DAE33584AA46557A74BC0C8B3233E72E90BE782F727D29E35B44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458201, "uuid": "5e25e94c-5ea5-46ba-81f6-7a1e5c91457c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458201, "uuid": "16ebceec-2304-43c7-b2d9-89fe1fc60a27", "value": "24576:ggrKOu57G7JLNIpt6TSTrkSgazcwjVGwcVRrppfSAsRzmpuilrJBeletr92s74eW:gg2f9GxNOtcSXkmGwcp15s84gx3zBw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786458201, "uuid": "f5289787-a367-484c-8493-f7e1f26f70e6", "value": 2805120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786458201, "uuid": "db519d20-20ba-4ac8-a0f1-99859c6b16ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458201, "uuid": "4a039180-c0ab-4ffe-9c3d-6b7f460f3fa3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eec3b4f-951a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786407511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786407511, "uuid": "2f1688ba-8484-41d7-9f1d-3965b0f5cc2a", "comment": "Malware payload (Mirai)", "value": "3c3d79b90c58365e307194a049c379c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786407511, "uuid": "1a9768f0-6856-47e3-a707-b64c006c29fe", "comment": "Malware payload (Mirai)", "value": "67f87dab198b2892965a8d03b42b89320fe53666be1d4b83e1c2e2632b8fcd97", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786407511, "uuid": "42886d0b-4b77-44bf-a2df-ef5b67074e9e", "comment": "Malware payload (Mirai)", "value": "96358772d1787d857578c30c0baeb35b210d0bc7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786407511, "uuid": "c7030fac-d640-4565-b60f-547e017cdaf8", "comment": "Malware payload (Mirai)", "value": "3e4be441b47156284de1bd0c0f3486b40869bc9dea465bd347d5c43b29e89cc0c0fe9648a7849f9192a0589bfed50b40", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786407511, "uuid": "a0b648e1-1b51-4e26-af20-ec0758c6aa45", "value": "T13053F1E4D5D928E5CABB99D502D133A017B0DF0A3365C4A1A6C763C9437710AAEA0FFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786407511, "uuid": "5382e5e5-28ed-44c1-adc0-5593e225a05c", "value": "1536:XwWpHNq8eN0Zyor4sOk6Tlhj5hGZMkOuG7Lhsw4u+qgw09h:PNw8yA4yejf2MkFG71sw4u+qgwQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786407511, "uuid": "e4c472c7-eb28-4dc5-ab4a-68654c8e77e5", "value": 61236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786407511, "uuid": "2d829916-568c-4e17-9e6c-c84fba7868dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786407511, "uuid": "c2cff529-bcfb-4cbd-91f5-95244dce1946", "value": "sdfjgnjsdf.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c419f0d2-95c2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786479917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786479917, "uuid": "feffe631-200f-46cc-90e1-438f1feba318", "comment": "Malware payload (Vidar)", "value": "065b9e2e193ae251e69736d1e99db51d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786479917, "uuid": "4f81d69c-7f13-4af3-a472-e0f1af4666ca", "comment": "Malware payload (Vidar)", "value": "68614059d4c6d3ac5393710de65523bf384be688735738d8d68c393fe1a84297", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786479917, "uuid": "1c29236c-2fc9-425c-ae25-042c38e2d9e9", "comment": "Malware payload (Vidar)", "value": "30316bb2a88bca516d7c4ebf76cb54779bf15f2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786479917, "uuid": "188c5189-e5bb-4956-86ea-c9421c71d6de", "comment": "Malware payload (Vidar)", "value": "3467705fc90e7e44c3eaa498eb807c550727feb1d14653fb1e945741e8b7d3486ef30a26cd8ae00d91d84967d12f9387", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786479917, "uuid": "fc466947-023d-4aa0-94d0-2385e8a5199b", "value": "T1F3167C03BC9188FAC4A5A731C8B75252B664BC084B3177DB2E60BEB82F727D15E36754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786479917, "uuid": "a50af5a1-0ca9-440e-bd7a-79ce0253e674", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786479917, "uuid": "bdae0631-47a4-4012-8a78-6ddd450178b9", "value": "49152:SY1QKPDHR0Q5eV7SJ//xf5iKvbWxynXKDGWWuZjwYl:SpH7cS+KDBZOA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786479917, "uuid": "5c16415e-9e0f-45bb-bfd2-f8b13811bde5", "value": 4196184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786479917, "uuid": "5bdc60d9-c9ff-4be0-a87b-21095d686df9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786479917, "uuid": "480ba011-a4a1-4300-844b-7fc2a431daaa", "value": "68614059d4c6d3ac5393710de65523bf384be688735738d8d68c393fe1a84297.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "239b8e11-955e-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1786436698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436698, "uuid": "68281371-839a-4367-88e6-638f9b2a7f55", "comment": "Malware payload (ConnectWise)", "value": "35079d90d4d414da6098fbefa9bbe7e3", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436698, "uuid": "e5d7a4b5-a520-4d07-a918-a7777632b788", "comment": "Malware payload (ConnectWise)", "value": "689e23389dbd9816e868e75afcbe4d2e799afc191d233b768a0469eceb0c7db5", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436698, "uuid": "059b128d-0774-4d2f-9d01-9e5e9f554109", "comment": "Malware payload (ConnectWise)", "value": "a4ba08b9196121fc545a8e20058c40a9b69046e4", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436698, "uuid": "490f571d-eea8-4d78-8d47-e4225647f188", "comment": "Malware payload (ConnectWise)", "value": "9c341d4c67986a071f8f8bc9d1af66c9882dc465a55004dd15b2357ffd27a31c0770d0bd9830f0544edb86f658006054", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436698, "uuid": "8a51a5df-e49e-4f64-8a90-631823eed5e7", "value": "T19DC61201B3D689B5D0BF0638D87A56665A34BC049712C7BF5798B96E2E32BC04E32377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436698, "uuid": "02d71fcb-815f-4cbf-b5a5-dcc3c9616df4", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436698, "uuid": "c6e90f7c-6032-40ee-8f67-430f5d1c7a38", "value": "196608:A1TfefPqRQyiixtMjGZ1jhlrwUCQyiixtMjoQyiixtMjXQyiixtMjBQyiixtMj:ACPnjGrrbPnj5PnjgPnjqPnj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786436698, "uuid": "c42b71fc-13fb-4dd8-aaf7-aedf1a7b0835", "value": 11624144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786436698, "uuid": "5bd7f381-7d02-4662-ab19-5caf5ca56182", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436698, "uuid": "2e5145fb-933f-4d57-b5ec-e7bab434a6d2", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a87b112-955e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786436817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436817, "uuid": "600433d6-4132-4e9a-b2c4-26ecc259e219", "comment": "Malware payload", "value": "2e538b578e2cbf6685b16fe18dcd3e00", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436817, "uuid": "e416e6c2-00e0-4f9b-8d37-f39ec841254f", "comment": "Malware payload", "value": "68ed751308c3949cbac5d6cb8052512db50c52fd7b5e4075bbf27ee7f78c5aaf", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436817, "uuid": "954bc160-f35d-487f-9fd5-607f79119778", "comment": "Malware payload", "value": "a47264ece35bbbaa4aa9222831f4e327160ae2c8", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436817, "uuid": "62d8823a-2949-46a5-bd43-c6ebba1507dd", "comment": "Malware payload", "value": "b89e706145ae6825c7981d97afcf45adcbb04ede5a3852d37947c2cf520d0ec46cbc137248e415079f1c8142b8053c36", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436817, "uuid": "a2f4e15e-fe7c-423c-98f8-123f3448c152", "value": "T13572A4F6C1CDF3475B68AEBA70F56439925F8AAC41E5D11B32C985E2FA591E0EC0CC42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436817, "uuid": "2aafa7bb-3fe9-43b1-9ba8-e572481b5a93", "value": "192:UhGImH2R7rEtMv0E2dLNWfm/umJrxahIc:uG1H2R7IqKLNWf6Jr8B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786436817, "uuid": "ca2f0f6a-e994-41f4-853f-084f5b48f18a", "value": 16118, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786436817, "uuid": "8447b19e-d7d0-4a73-a4a2-6241738e12c4", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436817, "uuid": "8cdcfb7f-fa2d-48f0-8be1-34f715fe9543", "value": "goodthingsforbestfeelingsarecomingformybest.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2462e96-95ca-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786483430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786483430, "uuid": "1659e067-14e2-437e-bdba-640273624470", "comment": "Malware payload", "value": "7eeebb87385ee0efb81ed1fb0b7e7139", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786483430, "uuid": "264dd92a-6512-4b16-88d0-bb8f07f93f29", "comment": "Malware payload", "value": "68f522cc3b4499eb9a8c2498a5883af103ddd8f1942239e58e30fd99af7810a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786483430, "uuid": "07765dd7-4c30-4076-a8c0-321f52cb0037", "comment": "Malware payload", "value": "60608b9049e2ab233ffd5edf5db110d994f44929", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786483430, "uuid": "bddf7fcd-2b46-4d2c-bea0-2eadb7cd1f7e", "comment": "Malware payload", "value": "48c619cc3d4ea5e3f47bf94041b550508b07c66adfc43b89efc46c8a258d38c70302799b56358cf5cc3a4adc58863ac9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786483430, "uuid": "5a69dd23-ffa1-405d-9ea4-9eb1524cc5bd", "value": "T11913FAC3FA1AC706C5C236B7F75D428C37296FACA3F9721299316FD023826D52936126", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786483430, "uuid": "cb095965-3118-404a-b3c7-a91196389742", "value": "768:BZ7gmZ2SYLbReRVOHxCJRadP1UsTHFe3/H/F+wGKzJyDeDKVo6xUf:T71SJHYJRaVasTHw3FOKzQDAsUf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786483430, "uuid": "51b04cbf-94aa-4526-818f-677c8e455de6", "value": 44504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786483430, "uuid": "559a6b14-cbee-4f94-bb5d-fd45a77eae5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786483430, "uuid": "270f5f40-ccde-4bff-a07b-422b78f17371", "value": "main.armv4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05190c42-956a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1786441800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441800, "uuid": "21584f98-fce0-430f-9e7e-14dfc494544c", "comment": "Malware payload (Gafgyt)", "value": "6e1f563475627547a89717b945b05319", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441800, "uuid": "fddcfc21-1991-4a82-81d7-ed202986c00d", "comment": "Malware payload (Gafgyt)", "value": "68feece51b734c46cd81c082c80515282a66da2872d3fe9c83c62199d9aba7a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441800, "uuid": "3f2ad105-34ec-4f5d-8863-5949e14c9db3", "comment": "Malware payload (Gafgyt)", "value": "4603ee4bb61f1c47f84a2d490736129f04e3e172", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441800, "uuid": "5ec84865-a486-4b0b-82c7-851257f0dd0e", "comment": "Malware payload (Gafgyt)", "value": "1c87c40b3a0167a90cb3111196dfa89d4a8ebbee92a38f7a2ea73b4f052d4cbdec0962149753b97cd8e00e35acb27a6a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441800, "uuid": "a965592d-a373-480c-8096-0448198b4cfc", "value": "T10FA32947B9619FB3C0829AB565FB4A304713E8955F4F2A5A31786AF4034F4DEB80EF24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441800, "uuid": "1c07825d-6b9f-4720-b056-9e3ec9c3a12f", "value": "3072:6f2QPyhYfaTzpTX6dblcBTP4/mzK0POjBfk9o:42Q6mszpDscNw/mzK0POjBfk9o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786441800, "uuid": "ef8a4522-a778-43de-a740-d3d28befb45a", "value": 105676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786441800, "uuid": "4a247db3-7ec3-4395-a60e-9ebcf6353c03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441800, "uuid": "544d12fd-67ee-4794-9d89-e9befddd2a7a", "value": "s-h.4-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbea744d-9562-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1786438725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438725, "uuid": "95462f84-c666-4f3a-b62a-4f9b56ca759c", "comment": "Malware payload (PhantomStealer)", "value": "fbbbb1adbafa50f62b32b4605d32d6b5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438725, "uuid": "09038a9c-e9ef-4210-a0fa-5210043320fd", "comment": "Malware payload (PhantomStealer)", "value": "69b233bb70a7921ca1b658831c224411e76e00daa3a17b243f4af30a25f75a88", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438725, "uuid": "c0307b19-cb60-4a36-b987-25553b1ac7e5", "comment": "Malware payload (PhantomStealer)", "value": "55881dc938292682793e726913edb5caa9f17777", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438725, "uuid": "d4bb1de0-0fad-45c8-b4d7-d548e45ffb82", "comment": "Malware payload (PhantomStealer)", "value": "37523445bfece83e66e3c72551c9c8c77761b046a2f7558be319ddf091d4c693095dbd7b2ec8ae06c26d4df79ba6d51f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438725, "uuid": "37f0f078-8505-4596-87ce-48ce2a83940e", "value": "T1FBF5E6812794AD327721AB9C923AEDF0E50A615315C6CF1530ACF6187B6CD0BE758AF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438725, "uuid": "63954ba2-2592-4717-99df-563ce0a5f9f5", "value": "98304:e30Iatpce54eNbQrOrlgpXmilQTBiE3WbBrp0JOdZW9cbAa6P8v9KyxSAqGkAwlk:eERtme5dirWWE/BiFbBrCmL6PbgSAUje", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786438725, "uuid": "66747c26-90bf-4559-a31c-f6fb7bb07663", "value": 3637166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786438725, "uuid": "d371d1b6-1130-4bda-8edb-7a3d40350f3e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438725, "uuid": "6bc28dd2-cc99-4722-947c-b8d7d963879c", "value": "Request for Quotation (RFQ).JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91c0eaaa-9557-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786433876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786433876, "uuid": "b72ec120-9a72-44ce-adfc-f7eb51c8c824", "comment": "Malware payload (Mirai)", "value": "f3446cf42466dedf2b8d0309efa4a359", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786433876, "uuid": "7c472508-bcc0-4bd7-9677-f3d541b96b45", "comment": "Malware payload (Mirai)", "value": "69e16f7c42c970cd85bb4207aa86f829f0e15a7cc8da969058028a351b965985", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786433876, "uuid": "eafad95f-24f2-4f80-afca-218bc8a82aa2", "comment": "Malware payload (Mirai)", "value": "00df0495c2de815da8bea24530dc38c095e10054", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786433876, "uuid": "ba4093ff-9d76-4c16-a2e5-02611826dab2", "comment": "Malware payload (Mirai)", "value": "b3adc5e1a8181d6c63ade3220dfd33625889a5af6ee054e5480b64cfb2bb5ffdb575cdfe561056d71234a6b94e55e1ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786433876, "uuid": "ba5410af-fa21-4315-90fb-ca3468c50499", "value": "T1B524D71A6E21AF2DF1AAC63147B74A21E76932CB17F1C646D15CE5032F2039D6C1FB98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786433876, "uuid": "739868e2-2c74-4018-a1a2-b0cffe96107e", "value": "3072:OWacuPVbOjYE4bvg4zcJYHexgsVnQFQtU:OhhVbOj94pwJY+WvFT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786433876, "uuid": "9f77c956-1f3b-4ed8-b725-c3aec1bc1fb3", "value": 223564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786433876, "uuid": "996daa30-d834-4d24-ae12-521997c91885", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786433876, "uuid": "a1402a62-15f0-49e9-a0e7-fbe1f6e066fa", "value": "tmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "707e0531-952a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786414493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786414493, "uuid": "dcfb15ab-d58b-438b-bad0-914787bdee05", "comment": "Malware payload (Mirai)", "value": "5a6c642d456699f34ec19e41282e1d2d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786414493, "uuid": "12985eb9-5fcc-45ca-b0fa-3a087119a815", "comment": "Malware payload (Mirai)", "value": "6abf0b2cfee342e686454b83371b2148bcecbd7a1c453a08468fa41a9713264a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786414493, "uuid": "4d6b1ada-8b8f-4efe-bb47-e6d4e8284110", "comment": "Malware payload (Mirai)", "value": "2648a22e2ca489915d15cbecc418cae27785127f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786414493, "uuid": "f3486e87-a7fe-47ef-a6b4-79ed1455b86f", "comment": "Malware payload (Mirai)", "value": "2e76d7acd2e8b3b9cf2f87e1659d8a8b17bc2879bd384565cf79110c1d3f777c998328fb8f8e431d7ec44bbc1b90b0d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786414493, "uuid": "1e6586f8-5f08-469c-a03a-3ecec5764b08", "value": "T1B853029A513FBBF6E821D176347A8181E4CA5B0E4657201B844E32EFDD75E35E40BBA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786414493, "uuid": "2c477632-921b-4331-ba69-717bbbe47b27", "value": "1536:EL+mwBspln3Dz5/FTywgEefUjC5n7nHAy379UQUdg6Jx+:oXwBsTBHgTlgUpUQUdgG+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786414493, "uuid": "f39001e0-3839-4359-8f93-d09e3d6704a6", "value": 64392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786414493, "uuid": "f275a23b-edd8-4d59-8a5a-64eb03cfa85a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786414493, "uuid": "885e664e-14dc-40ef-a5f0-17ca270b1a66", "value": "sdfjgnjsdf.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54b9e0d4-95d7-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786488749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786488749, "uuid": "4ef499c3-b2a2-4a42-b955-3d9c209ece99", "comment": "Malware payload", "value": "aa9ad49b08c2d5891864e9f35d2d1bd8", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786488749, "uuid": "73777e95-36a1-4a4c-83e8-868b72d620e3", "comment": "Malware payload", "value": "6acdba6f051b10a17946540acf04b6f3e3486db80bacc5120c0866d3489d87b7", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786488749, "uuid": "578e7fe4-e97b-417c-9c8c-28a9bea49cbe", "comment": "Malware payload", "value": "1a7995303bfae07772e199cd3afd665ea241362b", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786488749, "uuid": "edafe8d6-2c20-4b40-b5bf-a54f518aa772", "comment": "Malware payload", "value": "aa3c2d2a06c253bf1639890b3e29a234b7499dfc98f3acc5db11fbf8162aecb15ff5e2c502738b70ca8f4fafadec5956", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786488749, "uuid": "3d9f6651-487d-4d95-9c6e-b92ef5988936", "value": "T128E6334E85C831AEDA33C474BBD016A0295E35B94B7746F79BEC87A05CB71E0A53C293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786488749, "uuid": "15fedbb5-3a38-4b37-a6cd-4aafc8b3b8a0", "value": "976d2ad389e8b21847d44dfb70916b1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786488749, "uuid": "b83d8a66-9c98-4d4d-aade-1320c1e2066c", "value": "393216:+/1HLtWKpIde6T0W4+gXMCHWUjccuI3/PGTAI:85tbpIPAWxgXMb8JH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786488749, "uuid": "72cfbde4-fd7e-49df-b8c3-aa2059f846e8", "value": 13875365, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786488749, "uuid": "25df0d1e-9d38-446b-9826-e08416b0f839", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786488749, "uuid": "0c73f9da-0ff1-4c81-81a0-3fde79ed6d8e", "value": "composer.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed109bf3-955d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786436606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436606, "uuid": "0f76aa08-5c2f-4bad-b554-63c982ec8b17", "comment": "Malware payload", "value": "f5e280984950ae31faa056ce8efa56a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436606, "uuid": "e2304568-7d6b-44be-8ee8-14e8223ab615", "comment": "Malware payload", "value": "6b07eb8c0c2ab0ff4b51617bc7eed1742ef537e70dc61629b20be3bde09d4d1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436606, "uuid": "edf1903e-dee7-4039-bb2d-29a0bf32f62a", "comment": "Malware payload", "value": "f22a62250fb9bbb0d31a8632c82deee2ce1e467f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436606, "uuid": "dd97f291-88bd-4272-b30b-8e4bc7111768", "comment": "Malware payload", "value": "8b41e1ef564ab0f8d9f684a8eb98c3f220e44d0df2384982842a185baf32da4a7bdf1b2b5abf0aada433034628001a3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436606, "uuid": "be1b93d0-d6cc-42a7-ab11-d178a11d6cc4", "value": "T1B6D523987DF619B0D037C7B9CF82F0AD71297BA09BA04EAB37CD25409E226585D35378", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436606, "uuid": "250e1e9c-30ca-4658-99fa-6368b777698b", "value": "f5bec796b7b3c2932293afa8281cdeed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436606, "uuid": "4adabce6-406d-4bc9-b47d-27a6d0ab0de8", "value": "49152:emuIASnAOadKiXsm5w01+VVYt1EhpBq5QckX3U7J/5twzbJWf5RgaTqryQ:lNjnJwvXW00szEbBq5Fk071gzbJo5RvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786436606, "uuid": "bfa372dd-65db-4684-a063-7875bc61f3e3", "value": 2993152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786436606, "uuid": "ad3290a2-5d1f-4184-a267-66c992ad0976", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436606, "uuid": "b4866fce-ef4a-4b1e-8afe-74aab40d21cb", "value": "9z7BGnRGpgs8cZv7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2d51849-95bf-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786478680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786478680, "uuid": "3e8443b0-a54e-4245-a92d-857a8cfb5409", "comment": "Malware payload", "value": "0623070065d26fbb31caed539d83e3ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786478680, "uuid": "bf70db68-7426-40c5-89b1-f5c967cec11e", "comment": "Malware payload", "value": "6b38c8c0242c6b81008d4bf72378a2ad1537324cbe1ee6c6c55f0d21c905387b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786478680, "uuid": "bfa2052f-ba1e-4215-a384-26071a819591", "comment": "Malware payload", "value": "5fea99154d8a6f1ef5b04fd14d4a22a7185dd0b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786478680, "uuid": "29d4f9b7-c162-470d-86c9-29af66e35f4b", "comment": "Malware payload", "value": "030470ed49394e814f48e465b98f8fdba660230e9983e2b077dc48dfe6a54549b3296ec4432b877f1d030444d06a2560", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786478680, "uuid": "9424de15-b7c9-4b0c-81aa-ea04732e01a7", "value": "T1FD366B03EEA548F9D296D73588774242B764BC499B3533D32E60BA742F363D0AE79B40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786478680, "uuid": "c6c3a634-7ff0-40d5-86be-88d6ec6cb477", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786478680, "uuid": "42e6df5a-b95d-4e55-bdcf-ba5fc9018b03", "value": "49152:uFKpz7i7FAlc03DCBGcm+a1h6TczyJPj4RRHrYvAaaW:uc3XND1aJrCOkW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786478680, "uuid": "26c4d2d0-2248-4435-9ce2-974e604c340e", "value": 5002535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786478680, "uuid": "748146de-0c20-43ac-bba4-d9c485db6024", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786478680, "uuid": "2554ea87-76f7-4acd-b3b7-07d74de0ccd9", "value": "6b38c8c0242c6b81008d4bf72378a2ad1537324cbe1ee6c6c55f0d21c905387b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06b1c9d6-95bf-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786478310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786478310, "uuid": "50004219-61a7-4af0-9466-22dd852a967d", "comment": "Malware payload", "value": "6859c1063506de44c01a2768f72b4289", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786478310, "uuid": "f3c9f726-f7d1-43fc-a674-8b121274c4b8", "comment": "Malware payload", "value": "6c13df706d3c0b0409f25d519d7e907549c6a40e2f96e3b9e3c5bd725ee597a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786478310, "uuid": "30e10de2-8b8f-424f-9284-411624b4deb3", "comment": "Malware payload", "value": "80da70b543d4149a82723b497592d0d3152c9325", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786478310, "uuid": "7ecec5fe-af31-4651-9f14-2fc15c107bbe", "comment": "Malware payload", "value": "1f6b4d51d42b133bded2c7c33dd3e6a02c97edbb10a3a65fd8c8ebf1ef39eb9d319a956ffad05946fdf4a7e11630661b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786478310, "uuid": "b6c86a8d-44f2-417b-a179-1e46d6732581", "value": "T1DDA37370F90667B1CC720A38579A2F096E7705199FEB1A725D1F623DEE668108B30F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786478310, "uuid": "b1cada2e-e040-47a4-8b2d-6427277dbf32", "value": "1536:Yb/MhLEQ9QHp2rZuuO9uuuuuuuuubeK1JxwvuEnsatHHC//5+EFB8M6hxP8+JWYN:i0FEQ9lrsWxwvnxY5l6LfW3i3y9U9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786478310, "uuid": "137fd055-b6ea-4b16-a3e9-89698a210f0d", "value": 107180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786478310, "uuid": "d3754668-9bbd-4f60-b2ce-63d51501118d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786478310, "uuid": "4e893d75-e478-46db-a966-72903172c452", "value": "main.microblazebe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "021e73fd-951d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786408724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786408724, "uuid": "8f3862fa-1271-4c3e-9ad9-9146bd85382e", "comment": "Malware payload (Mirai)", "value": "d7215d75e44df394d2ebaabcbfe44bc0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786408724, "uuid": "abead1ef-d010-432e-b1ab-d478ff10763b", "comment": "Malware payload (Mirai)", "value": "6c23a44f0bb66ed004961a68a417cd762e2a4a6395d01c53908324f7e9e803c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786408724, "uuid": "9a0bf2f2-6967-46ca-a4e7-b5c007701011", "comment": "Malware payload (Mirai)", "value": "14c16892046cc5d1c7cd0c06095e6967a92f37fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786408724, "uuid": "eba09f93-6a84-4af3-9b4c-e288801bd306", "comment": "Malware payload (Mirai)", "value": "54c6a39b23f62482b614b36c551a9943673578870c85850b925ad43965a9ac617af740193fa3225513c50d684b148ecb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786408724, "uuid": "9c4b16b6-9b18-4809-bb48-9b2a8af93821", "value": "T17584E096F7023E82C8D7C57519C681895789E95B33F383463B42AA7B3C397368F29385", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786408724, "uuid": "f31d409b-e283-43bd-b8d5-4668f800f40b", "value": "6144:eoa8sPtcnDGGzryRQ1vqGsj4GV+Aw8Y4Mi8pL+TKH:Da8sVcZAiskGV+Aw8Ys8pL+TK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786408724, "uuid": "dbdc15b1-076d-42f7-86b7-8cfe9006c151", "value": 391628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786408724, "uuid": "20ca4eda-ccb2-484c-9ceb-f7ee9a88d3be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786408724, "uuid": "27a97ef4-7f10-4224-8879-80342f901be4", "value": "6c23a44f0bb66ed004961a68a417cd762e2a4a6395d01c53908324f7e9e803c9.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1537ec4a-95d9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786489502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786489502, "uuid": "04042124-7faf-4654-8781-14ba18c61a02", "comment": "Malware payload", "value": "552157efbfdb0e50e50ab0f9b0af5221", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786489502, "uuid": "0fff02ac-751e-4e20-8dc0-acf6b2f57a29", "comment": "Malware payload", "value": "6c5475219e3f757aeb1901e13dac29a647318666f553d1af848c45eee7788a88", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786489502, "uuid": "ef7bc71b-7628-43ff-8d2e-1218ce7c1c2f", "comment": "Malware payload", "value": "8989a43467d166322d3b08af22454bab5e5dfa17", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786489502, "uuid": "9f4236ff-79db-4c11-9ca8-f659e0b0f0dc", "comment": "Malware payload", "value": "0cd7a6ff4380b5dd429240ae6dbedab572a2c60fa64d3f97844e4cbbb3f8c60d1d737d34a969df57f5c8ecb0ea97fc7e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786489502, "uuid": "8112625f-e4c2-4245-9655-0b372c435594", "value": "T1832733FACC4C131FD14BEC729C56839FA28685787646D4B7803CCA5ABC5A5E4EC61C3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786489502, "uuid": "869e4773-8372-4d8a-932d-bcc90cbd3c81", "value": "393216:YML9y+5b7ij5qACQM0Os0HpQiI1mFPHyv/eSSSFcGfdiuZNOcpPx+cIUOdHn/:sibq57CQasiQiI1ySXrHFcEicNOchxox", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786489502, "uuid": "214d9822-4cdf-4f47-8cd0-a6ac2d629c95", "value": 21132066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786489502, "uuid": "dcea095f-4307-4c1d-9ec9-4cfa36aea03a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786489502, "uuid": "0e458886-8cc4-481e-8494-61715a6588ab", "value": "cloudAP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59061802-956d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786443230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786443230, "uuid": "d0639557-24b5-4975-b65b-75a93f74d2d5", "comment": "Malware payload (Mirai)", "value": "5f513a2b0297a3b35f738225f0c0d15d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786443230, "uuid": "0cb836ce-1ec9-46de-abea-ee854206c57c", "comment": "Malware payload (Mirai)", "value": "6c72a8d3adf00b0c13164df53ad67796a4d363976eb7f11a0ef7c0ca94365c4d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786443230, "uuid": "b2acf57d-d55e-42a8-a8ac-f124526bbdd3", "comment": "Malware payload (Mirai)", "value": "70c6d6a3dfe3ca18d17afa12bb67b65ea058f31f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786443230, "uuid": "073a900d-0341-4af8-866e-7f7531774b50", "comment": "Malware payload (Mirai)", "value": "2a5c89fee5c50e0f1331078563d3850f0f599810d5aaccc6b49768e68372003d3b65432baa162a1ecf7e1eb003f7f88f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786443230, "uuid": "b0d343b2-06ec-43f1-9779-d508338de730", "value": "T1E7242902732D0A43D15B1DF026FB17F1839BAD6019E6A544F21EFE885772FB1A506F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786443230, "uuid": "917881db-021c-4460-beba-e6025872e506", "value": "6144:Ys+xFjYj/MnvyoErA18Q+mkq4+lhlZv1H0hjtatW:Kvy7rLmkq4+lhlZv1H0hjtatW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786443230, "uuid": "af847ae5-bfe3-4c64-beac-3a655e455620", "value": 218460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786443230, "uuid": "c474fe19-7e64-472b-b5aa-636680a6d0ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786443230, "uuid": "2ecd7951-2131-4f81-97a7-b87527600ddc", "value": "ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ffcb1e7-95bb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786476608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476608, "uuid": "02067400-f58d-4722-b557-61685e8a96d7", "comment": "Malware payload (Vidar)", "value": "3e0d440f7d4e19e2ae4def046cf05c5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476608, "uuid": "74f6fe87-7f29-4b07-8953-637dcd4b3823", "comment": "Malware payload (Vidar)", "value": "6ca1d0647fdc1f2deb80e387b66a4768397ab77a9c7db617203fa605c5c0dc6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476608, "uuid": "3506db20-7353-4613-a664-a3d99d33e68c", "comment": "Malware payload (Vidar)", "value": "38e6caeed78d5aeacabdc5397ee077b43395538d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476608, "uuid": "84673d6d-75b5-4bc2-b5b5-6474e62c55cb", "comment": "Malware payload (Vidar)", "value": "26072377eafc07745e3671ff3baae35bc75651ae891c9fdfec1a10418b83872a8381b5d75bf2b06e2af46af24d0b0bde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476608, "uuid": "9adde6fd-f1eb-4f03-bd03-2b8b9d817647", "value": "T15016AE07BD9144A8C4959B3688B712527B28FC0E4B3673E72E91A23A3F777D19E71B40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476608, "uuid": "a5c80c09-ced6-4219-9346-45574d0348cc", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476608, "uuid": "77933590-a7b7-456e-8bd5-ad60450d1381", "value": "49152:UAUuLRNbGzMi4lnap3EUvB6GbEd9x7r7m8vlzXksBROap7PlWb8YDTSw2SG3vxnZ:UAUqBln0BdDLRCCG2qGrG1eZJ05Xl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786476608, "uuid": "e6108352-d56b-4bd5-959a-c96c790022d0", "value": 4313384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786476608, "uuid": "4ad5a274-f1da-46bb-b12a-534f578beaed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476608, "uuid": "03c1e964-17d0-405f-a9b6-3edc15418daf", "value": "6ca1d0647fdc1f2deb80e387b66a4768397ab77a9c7db617203fa605c5c0dc6b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "984a79c4-9579-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786448490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448490, "uuid": "0e71cc7c-a5bf-4a17-8e4c-d8c73ae4c315", "comment": "Malware payload (Vidar)", "value": "4cb32af454ffb90522b70ce0a9585685", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448490, "uuid": "b5268aec-6a3a-41c7-8207-368f3acc5065", "comment": "Malware payload (Vidar)", "value": "6cb6186226f28dccb2fb06abf7a7d0cf6348b0f5980aa54361bdcc44c0d8014c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448490, "uuid": "d7df25e3-b201-450b-a690-3f7855dc7158", "comment": "Malware payload (Vidar)", "value": "f628ffd3586f8703177404d8844bea18506b79f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448490, "uuid": "fa54e004-0882-433b-a6e4-0bd8c351d49e", "comment": "Malware payload (Vidar)", "value": "2d34eb57c5cc36148b3dd5e80e76e84fbf653ff2ca938f9fea434d372607de489159a5364cf77f5cd52232021614a428", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448490, "uuid": "0452e99d-5604-4e16-be86-1613c8df6f7e", "value": "T1E2169C43BC9019BCD499B33088B352457B78B84A1B3227D71EA17B3A2E77BD19DB6350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448490, "uuid": "f627dba3-694a-45b8-a37d-a2275f84ce47", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448490, "uuid": "a1e89e2b-809d-47cf-8612-8f201f5437f5", "value": "49152:zMqdkV7XVfR+gGfNAAM9uw1NS1+NgM7WUxDYiDYKh5gBhpacTAQ5FApo3PC:zSYrSDSk0uu9XAyPC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786448490, "uuid": "80956ea2-eea1-4d2b-93b8-0a93861727e2", "value": 4235336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786448490, "uuid": "e6017252-e8af-4661-a307-ade32bf843ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448490, "uuid": "65453432-f7f5-4354-a082-478d8fa463dc", "value": "6cb6186226f28dccb2fb06abf7a7d0cf6348b0f5980aa54361bdcc44c0d8014c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d34506ad-956a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786442146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442146, "uuid": "c14f3260-3644-4530-a07f-c116cde46e9b", "comment": "Malware payload (Mirai)", "value": "a01e6dd3ec7f67ea7536e649a1aa7ad2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442146, "uuid": "429841ac-ffce-4997-9584-36eae06060b7", "comment": "Malware payload (Mirai)", "value": "6d10bf73516f8aed08ffb44abd0391184763d9913405c90e004d92b9579f5933", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442146, "uuid": "752235b1-4ba8-45a1-9ee2-e3f739783621", "comment": "Malware payload (Mirai)", "value": "3d2d34ec03b5df51ed84a5ff250377088f70b680", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442146, "uuid": "c09c1c7b-ac68-4124-a002-6071ccac88eb", "comment": "Malware payload (Mirai)", "value": "f03f7420090ebe09be099103d8e8ef0b33c79af8d2456cb853b50cfdfec8e3ecf80e77ee5e856a52abe81837b8f65ada", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786442146, "uuid": "ffe445d5-21b4-4b85-8a08-72c41b469c83", "value": "T12AB35D21B5391E2BC4E1A47A21B74752F1F217CD26A8865F7D720E8FFF216402943BB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786442146, "uuid": "11955ac4-1fcd-4291-a517-443a927620ae", "value": "1536:jiFsr99tQrw5xlq3PHkvIdgMegcSUXkWmKwjhIGIqBj1aFHvtrbGYm5hrvrEAakK:WmR8eG4G5J70NhqYOC/FP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786442146, "uuid": "0be8c0b4-794c-4a37-87c3-1424c49d50b3", "value": 112392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786442146, "uuid": "9f304eaa-74ae-4b2c-940f-ce5713c2dcb0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786442146, "uuid": "21b0c2cd-5335-4155-9d20-3a92052f43c3", "value": "Mystic.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5b80f84-95c2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786479919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786479919, "uuid": "14b14ecb-110c-4eda-97b0-facf1c7d11ff", "comment": "Malware payload (Vidar)", "value": "9f25475948fa242f2a963c647eed8ac2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786479919, "uuid": "9cf896d5-3c9b-4a9f-9fe1-3c5dd039c7ca", "comment": "Malware payload (Vidar)", "value": "6d38087bf45c2b863fd02b4dfd96d4eb8f293d38ce125b3f47e0260ab2f5acce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786479919, "uuid": "ec7f11c8-6aed-4c52-8633-6baeb251a021", "comment": "Malware payload (Vidar)", "value": "a610277286c42b4529b168486a436de7f1f2c164", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786479919, "uuid": "2689da13-11e8-44d2-92b1-a998e33cb49f", "comment": "Malware payload (Vidar)", "value": "015c0cdfa8a5e41b3637321308bdc4d6e111e9d1933b047877b6d51c4a510c0f1418e5d26a1b039f0c923e4a1e252393", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786479919, "uuid": "f9bf540d-0028-4e14-9666-250ee306a3e3", "value": "T13EE58D5ABC9059FAC0A9A37289A264657B35BC094F3233D72F90B3783E72BD05C35B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786479919, "uuid": "53bed408-f965-4732-9080-0a0811072b79", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786479919, "uuid": "4349931f-33c8-4d29-a9cd-52673d3622f4", "value": "49152:QFsfM7fYtEhKfUR6gNnU0CwFcQ7C2lMeqIOsnBTEz97a:QFVzR6Cwx2ezITyW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786479919, "uuid": "ca7ece84-7dca-4bd2-92a1-0a5b25c5a509", "value": 3225984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786479919, "uuid": "5085e0c3-fb0e-415c-b97e-1643af57ac9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786479919, "uuid": "5de7bc7e-76f2-4b28-975e-854150dc4833", "value": "6d38087bf45c2b863fd02b4dfd96d4eb8f293d38ce125b3f47e0260ab2f5acce.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b736cbbf-9562-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786438663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438663, "uuid": "67805ce9-4551-4bcf-8cd3-863bf8a033e5", "comment": "Malware payload", "value": "3d9474786ec3bdf368abc8e293e7d1dd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438663, "uuid": "69a88e63-162a-4907-bd2d-be6d854e89e6", "comment": "Malware payload", "value": "6d60320e2bbdbed2277749d47e131bdfd5246cc943d61ba53b06cc565e1028dc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438663, "uuid": "2c9eade2-a348-4bf2-a924-c506cbd952ec", "comment": "Malware payload", "value": "b5f111bfcc60cf97a88235e3b92b7847574fdf03", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438663, "uuid": "4dc9f732-eb46-430d-89af-8ecdb1453d27", "comment": "Malware payload", "value": "38868af04eb4d28aa242d07143f063de30ecc8c43862e4817c66dcbbf8e58a7db5ff1d9042f599fe0190331440afd06e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438663, "uuid": "620b73cc-ac0d-45de-9e90-e263f3f63a61", "value": "T106C4CE2D29856848B036A512DBCA9166D26FFE9FBF4F1D0A119FC2CC07E26049D43DE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438663, "uuid": "8e255652-fb0f-400f-888d-e6e5c5af1318", "value": "12288:j7eBjas78YEVk2eNVBBdrsTQwhOvTbMM3Ql32YjnxAIuv9zDtwj2hWPqriTb7EJe:j7ejas78zeo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786438663, "uuid": "bf728070-ffcd-4560-ab5c-a024fbf3286c", "value": 572754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786438663, "uuid": "57237638-4d31-4ecd-9d04-51e6f8a6fcc5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438663, "uuid": "f542ecd1-bcc4-4fc3-8378-16acd180669f", "value": "Quotation.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "277e007b-9569-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786441429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441429, "uuid": "b52cf0b6-9675-4f52-b41d-1dabdc9fa484", "comment": "Malware payload (Mirai)", "value": "0bcf26555601116b3f597cb74a15547a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441429, "uuid": "de9fa0a6-83de-444c-8903-2b87588896cf", "comment": "Malware payload (Mirai)", "value": "6d60fe194bfe71bab9b17ddd48c5138f5b02959edc548288f2668ed4eb2a2501", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441429, "uuid": "906428b6-55d1-4c78-9ac4-bbb60095645b", "comment": "Malware payload (Mirai)", "value": "5d797507a3002fb72ec4224f9c65ec49793b9d88", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441429, "uuid": "169a1827-679e-4803-83d0-1f7a1ce1fc3c", "comment": "Malware payload (Mirai)", "value": "00a323df743b8d6d80333cc33a8c63262ac190bec7f33c6d214982dff9f627507a08c09ce13653393b4a0ba39b72eaf1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441429, "uuid": "ba948406-3c56-424c-b4b8-7f27c9d18f17", "value": "T16C142956F8819F15D1C502BABA2D524E37271778E2DF72029E109F74BB8B86B0F3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441429, "uuid": "d127e847-742b-4716-9f65-592b512f7706", "value": "6144:frN/+939v+61zDCbnbufJaN+lsY1ChJu4DFW3l6:TN/+9tv+6IbbufJaNa9ChJu4wl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786441429, "uuid": "81b668f6-1993-4baa-8330-304ed140a9db", "value": 208948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786441429, "uuid": "9dc1baac-4116-43d9-8ee3-bd3a7fe10d6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441429, "uuid": "b759a1d3-f7d2-48f1-9975-9cfdf44264d9", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff935cd3-95dc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786491183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786491183, "uuid": "09f94c34-75d8-4391-a118-4ce937a88b2f", "comment": "Malware payload", "value": "9c5de1e1feac9b42bead7f274548fe16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786491183, "uuid": "bc38cc8b-6e29-47dc-978a-6460550d341c", "comment": "Malware payload", "value": "6dbc9a6f4db478eb58b3a0b01d77cdfccd06bdeba97d506d9b54282405812960", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786491183, "uuid": "32bf621b-9690-462d-babf-f0c1baccf68a", "comment": "Malware payload", "value": "37f881160f2855db967cd20b5a09810eb4f6b48d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786491183, "uuid": "cdb15245-17a5-4640-af24-1740c4e5c899", "comment": "Malware payload", "value": "d17a69005c20ac08d4809dd8981c631ae8d37255857f9b076ba2f7b7c8541bec864cb263297a9158825d81ba9653917f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786491183, "uuid": "ae2ea3d0-f1bf-43d1-9966-8e33053d9f11", "value": "T1A7666B5FEA129578C098E634497672B67AE1B84D873433B31D32BE702F617E04E36798", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786491183, "uuid": "b8d4da68-0842-4609-ac0a-9beec79d7eea", "value": "a754f7de450555545dabf5bd2540932f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786491183, "uuid": "74119274-e325-4aaa-9309-de92a24b1fac", "value": "49152:00BF+qFPmVAqX/gvhVqR921zheI2u1CjlEpY9t3y/FICzIrMNwSRwZJ6omf0eMY2:06JVAZu1CjlEpcsd9qPE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786491183, "uuid": "66019b0d-9e32-4142-8d89-784bb723ad41", "value": 6696448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786491183, "uuid": "6c5861a1-c043-444a-ae14-cfe8273d6915", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786491183, "uuid": "b4220b90-963f-402f-922c-3f5c9ed637a0", "value": "6dbc9a6f4db478eb58b3a0b01d77cdfccd06bdeba97d506d9b54282405812960.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22a972ce-958e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786457312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457312, "uuid": "3b995f00-6f68-4b1b-b59c-622ab57e69ad", "comment": "Malware payload (Mirai)", "value": "b74117995071e20744db1fa6b16309af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457312, "uuid": "ecf5b6ba-e5ab-4c8b-ac42-997a3f9fd0ee", "comment": "Malware payload (Mirai)", "value": "6dcf04ab8edcc4ee0cb5437aa39a3a0a896c7b9f7ce873c1a53ee0dfa976f32f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457312, "uuid": "93d53d8f-4084-44b2-bce6-7099b40988e6", "comment": "Malware payload (Mirai)", "value": "6a870d184f6c249ad8311034c2f2e790afab4a8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457312, "uuid": "4da8ba34-5ace-4ba2-ad28-d7599f284ca8", "comment": "Malware payload (Mirai)", "value": "427909ed0247ced50682889552c1e4cd4178e7121076688968b8916297c4e5597d6497c09987cd407c9a7aa84eafa417", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457312, "uuid": "d6e87fad-d58a-402d-bbe9-87e28bf9067a", "value": "T1AFE30A46F8814B12D5C111BAFE1E528E37131BB8E2DF73029D246F647B8A97B0E3B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457312, "uuid": "55d80d20-6947-4722-915c-4f6c4ee8cd13", "value": "3072:SneaYCpeUa0NpgX0zXzztaMf4edUskfEvLV:qevCpet2gXeXzZaxKkfEvLV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786457312, "uuid": "0180d4b5-66e7-447e-882b-a850efb3d51c", "value": 144124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786457312, "uuid": "067662b7-c832-4aa6-9e02-a0e548508491", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457312, "uuid": "fe6ca11d-e6a0-4ac6-8a3a-8d484c705c19", "value": "bot.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edf47b01-959f-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1786464954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786464954, "uuid": "9b26dd2b-7b26-46d9-9a7a-dbbce55615a5", "comment": "Malware payload (ConnectWise)", "value": "7ea8d1a2fb41b0b916647affd6214173", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786464954, "uuid": "52b26ee2-2eef-4900-b29e-732b718c2cdc", "comment": "Malware payload (ConnectWise)", "value": "6e1b2975aecec56960fa56ecbc7ed189f506a577561a9e5ca9a25d6ca73d23f7", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786464954, "uuid": "865d9b7a-165a-4ab1-adfb-d1d8ae3712d5", "comment": "Malware payload (ConnectWise)", "value": "fb77e30ea047fb9a0b3af0ceb0cfedc9feae060e", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786464954, "uuid": "71d44e67-a691-47c8-819a-5f97e04811b7", "comment": "Malware payload (ConnectWise)", "value": "b744c4cde273bbba4315cf2f5834b8a69be7f2e797e9bdce2c9e14683eda1d1ac178709b9d15c13df3c1f238f8762b8b", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786464954, "uuid": "47a653f7-ebf5-492b-bf65-de153533a203", "value": "T145646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786464954, "uuid": "e159cfc0-2d36-465d-b6cb-3882c5994bec", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786464954, "uuid": "f5061d06-93da-4903-812a-89fc6dbccf6e", "value": "6144:ymlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFvi9hPh:R1iw7gryNkSV1hy1Z1u2JLa9hPh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786464954, "uuid": "2d59da9d-a007-43a0-95e2-892125ea57a3", "value": 312592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786464954, "uuid": "91b68d3e-af15-4a9b-8c4b-143a8a95c1dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786464954, "uuid": "18b29eeb-ef5f-4ec2-b5f8-a25b84a5222c", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cdfe306-9573-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786445813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445813, "uuid": "30eb72e7-709d-4e71-80b2-1ceba144b3dc", "comment": "Malware payload (Mirai)", "value": "f30ed7b43f4acc2a54e8a90d4898ccf3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445813, "uuid": "47bca5b6-1c5f-44e4-b583-88477c8b8e09", "comment": "Malware payload (Mirai)", "value": "6e5274a3c76ab1007dd5f2003e1268449dfd74e3dc41a18b772ac79519436913", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445813, "uuid": "eb4eed4e-d5ad-4777-ac42-79f379f25423", "comment": "Malware payload (Mirai)", "value": "510d5d1ea3ad176c5be3ac848faa92d61b92e86d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445813, "uuid": "1b4e615e-bea0-4ccc-8a05-dfa032391f47", "comment": "Malware payload (Mirai)", "value": "ad42b1e917e8e86e9a47989b402a2f8337809e52dc811b5b3deb7eab81d122ae0f99f8c0aeeed77021a1081e29f5e128", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445813, "uuid": "ad250cba-dfc7-4976-8a8a-2aaa5f772935", "value": "T1BC8312006A017AB324A53533EB64C7E7F76B8AFDB6F670970570069CB6DA2119F2D1C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445813, "uuid": "6967a3c9-b02b-410e-a7a7-c53a86172dd0", "value": "1536:k+ANdYgnEfl9h/QxsUxOO4lasj4hCiY9GFr0LnwbnpsPkL69hqRZZ0wiLa1V2fOX:k7gJx/QRsj4hCx9u4LcpakL6iR3w21xX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786445813, "uuid": "2de86fb0-15bc-4344-9382-152d2c5a59b8", "value": 87336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786445813, "uuid": "ae1aa04f-c435-416d-9aff-3befadc63af6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445813, "uuid": "87831e8a-20b4-49c4-8921-a43c4109657b", "value": "sdfjgnjsdf.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c97af206-9547-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786427098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786427098, "uuid": "98dd0108-2a46-4065-bd28-0dcabf37915a", "comment": "Malware payload (Mirai)", "value": "c795f261aff4f2dcf2d0dac6c2cd9348", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786427098, "uuid": "69e25681-acf0-4ebb-bff8-590e6be78d9c", "comment": "Malware payload (Mirai)", "value": "6e748948aa9230adda8fb8a7c7d2c5c58db8d1cd4893e0a92fe8942667610c19", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786427098, "uuid": "ddb0b5a3-df68-4e70-a4c5-cac898d80411", "comment": "Malware payload (Mirai)", "value": "ccf53e82a1f85ab6e8ebb0f8bda2e62cc0056f40", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786427098, "uuid": "d8b62201-4632-4a27-b8bf-c7e0a12d3550", "comment": "Malware payload (Mirai)", "value": "c98b8091c5afc01c878eec09e037e7d3c421fd31212c566d01d212f345d0e5c5614ea3e831db80bae62e3c08825b1e54", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786427098, "uuid": "08f4cf23-442b-4c5d-956c-40685c6c8164", "value": "T154B39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E72C6A657968791CF8906F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786427098, "uuid": "8c44d5ed-27df-41f7-81c7-1015679c20b1", "value": "1536:Fu27gBY9FSSpj3z5Qxw6YaWWgg13/LWy:c9sSyzz36YaWWgg13q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786427098, "uuid": "82d48bf3-abe9-4a64-b656-ec27dc03eaf5", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786427098, "uuid": "7e27fd61-7de8-4877-8895-5273c91648be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786427098, "uuid": "e2b86da2-46ec-4145-b950-ed96282f3244", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd1bc655-95cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786483878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786483878, "uuid": "ae768e5f-5eec-4ed5-9c36-e187fb668f40", "comment": "Malware payload (Vidar)", "value": "7934a6dabd9def8cf3a9ad93c2606492", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786483878, "uuid": "86742a35-2ec3-4d9e-a869-d08aadc61e19", "comment": "Malware payload (Vidar)", "value": "6f0d20d3810c9caa4ef6b0bb2cdf48dddfa4085d9209a25a83c4da72876577f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786483878, "uuid": "a32615fb-109b-4c26-9b54-ddec35bccf7c", "comment": "Malware payload (Vidar)", "value": "49e09fad00d52cba1a94f7f91885088797a4eb22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786483878, "uuid": "93b9cfe3-a9dc-4eee-ad85-adc360c5a78f", "comment": "Malware payload (Vidar)", "value": "087cb17084732f19dafc8aaf7943255034d9419735a31f7994b59e3df97359c66c60912fdeb65d563803b0f02c0d5ad2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786483878, "uuid": "8f57a301-90c3-4e23-83d2-759ac38e9290", "value": "T103D5AD0B3CA109EAD49A527688B652827B34FC194F3633D72E90B7383E767E15C35B94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786483878, "uuid": "e34c190f-b7d1-4271-967e-ab7088bca9b0", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786483878, "uuid": "cd99a894-e699-45cd-95f8-1a110e4ed139", "value": "49152:PmDPtcXnerB+cUXVJUt3fKx1SbUruKFnTYCWVg8:PIq6Ulu3fK6bUrzxY1b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786483878, "uuid": "f000a6a6-5880-40ad-baec-8c0d9f93805c", "value": 2995591, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786483878, "uuid": "e7e40e9f-0715-43d5-902b-5a2712032dd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786483878, "uuid": "ff5ad4e8-a1b5-4da5-ba93-25ff70689895", "value": "6f0d20d3810c9caa4ef6b0bb2cdf48dddfa4085d9209a25a83c4da72876577f2.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5522fe6-955c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786436056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436056, "uuid": "e662fc7b-ae37-40e9-9627-3d442d37142d", "comment": "Malware payload (Vidar)", "value": "be3cc7de6f3b5d1f4c30e2b40a59d5fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436056, "uuid": "0779ae56-7ed0-4f43-833f-0e70ad748a8b", "comment": "Malware payload (Vidar)", "value": "6f1a14032ec243511602560ef70a308e80b22bc6cc98234143b41032be861943", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436056, "uuid": "752f63ac-fe54-4366-87d7-de60431d9e01", "comment": "Malware payload (Vidar)", "value": "69b4a5ae57510749ce6cdaeffc6af39ea8cff629", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436056, "uuid": "f19948cf-05a9-443f-9028-4ace025f9c6c", "comment": "Malware payload (Vidar)", "value": "b17a4c1ff067b7579109df8108f7738c1d0c1c23e6bcbdcc562f5583272220d65eb16db70d39ca6de329b300c3914ef9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436056, "uuid": "738286ac-7d75-4506-8fd5-cf62f9a9023d", "value": "T131C4020AF7EA61F8E137C97888664A52F777396607509F1F4360C6726F236A0AD19F30", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436056, "uuid": "0d3bc2ac-f5ea-4f2c-8ee9-b296ec0fe4ef", "value": "36dab651ebd71b404011f23a733060ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436056, "uuid": "e1cd0e87-5a35-48a4-b91f-70c23b3681f1", "value": "12288:jIG1SaD20Nzp5ETcbseW1o7exDQejfCysMKA40xxoCBrFzjnEqKB5:waD20NJwekoaxDBjfjpKA4MxRfO5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786436056, "uuid": "97363942-54b5-4c98-960a-5fc7f381202c", "value": 596832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786436056, "uuid": "9f010808-98f9-4f32-b0b9-daa51cc34869", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436056, "uuid": "422a0b44-28ac-4ef8-b148-0bb66dfde8c3", "value": "v49922.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45a8b763-9560-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786437614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786437614, "uuid": "a6b8e870-2c9d-4cd4-bef6-8f9d3531bf83", "comment": "Malware payload", "value": "ebf597847a38cd0c4172568b4afe0a50", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786437614, "uuid": "9fdeeb36-6f4d-4888-b380-e69e1460ab72", "comment": "Malware payload", "value": "6fd3c02d29182a9b6f83f35cde1a484fea87fc85228b4aa229ae9d572ab849d1", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786437614, "uuid": "cab3d9f2-9eb7-493d-b800-d0dc588d516e", "comment": "Malware payload", "value": "b911ed66eff2a88f59aa962a5837014d93028e32", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786437614, "uuid": "d2f7cc6a-3e4a-4028-9c39-c2be6ff58318", "comment": "Malware payload", "value": "14150871cd160495f20892f595f51f5b15d512a63a23addb541f80255486a2ad71f134638df44ed87a7126352523ffa0", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786437614, "uuid": "2b0d4502-88e5-403c-8799-366be7cabb32", "value": "T1DDA512EB79AF9550F8126CB1BD8145551E2F20DB09816EAF37328F81219D478A1FFBE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786437614, "uuid": "e4c457c7-9716-42da-8e9c-d4cc75d3ef60", "value": "768:u99999999999999999999999999999999999999999999999999999999999999c:IUl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786437614, "uuid": "e9740443-38d5-4269-bcfe-06b8ce12102b", "value": 2176702, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786437614, "uuid": "72d23a2e-aaa1-4c24-b0e3-9a8a730a1454", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786437614, "uuid": "85aab34a-1930-4e13-a6bd-d4db5513a947", "value": "goodthingswithbestmagicalthingscomingforme.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ef29ce7-9569-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786441602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441602, "uuid": "88bc7295-2744-47ca-8164-14c7a4480e2e", "comment": "Malware payload (Mirai)", "value": "4fb75dc63e7da4ae21fe5fd1ec2b3246", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441602, "uuid": "62bd4fb9-2103-48e6-aea4-50033d6af788", "comment": "Malware payload (Mirai)", "value": "6fe4a29aea5a0488b8fac768a0dfad41e3dafd3ba6d3b761b95f9fc2e46b356c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441602, "uuid": "0b53110e-97e5-4f30-add4-76eb2f30d302", "comment": "Malware payload (Mirai)", "value": "cd4fb092d988f145bd88915b3b9426b9a40d7772", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441602, "uuid": "1589eee7-cfc5-47d4-a7c0-076453610f43", "comment": "Malware payload (Mirai)", "value": "af457bc0cc3e346a8768406400ce15e0f35d1f5b40ec66385ba133a054e510d3d768fb74612abc56b2c5249f47d869fc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441602, "uuid": "b0bb8cfe-e164-4497-8826-7ba09a6f9937", "value": "T11A51B6C561A84C383CE3FA13E6BB612C3091A65219FDBBA6E9E4BFF4524ED143144753", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441602, "uuid": "5f430db6-07de-4df6-aac2-883164339470", "value": "48:vH7C7N7hH56GHghzPHpKWHroUH7r7o7UHfo3bHS9RHvcgHupVHhSOH9+CH4fTHga:vH7C7N7hH56GHghzPHpKWHroUH7r7o7q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786441602, "uuid": "62f0ebd0-8019-45b0-a785-4ef722902442", "value": 2940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786441602, "uuid": "517801eb-4861-4c4d-ac7b-efb3c2c23926", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441602, "uuid": "0f8e7468-b2f5-4367-beb6-d466fcee4b05", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6fee2fa-955d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786436489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436489, "uuid": "63bbc303-790f-468b-8581-d66cc97bc2cf", "comment": "Malware payload", "value": "fb0ffb790ad4758d97b16d1299e53ef7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436489, "uuid": "e8665d8c-5aca-4ee9-bcb4-79b80a0455bd", "comment": "Malware payload", "value": "6fefd8b0652b048fabd91fc1d34842df46859b6956294a6dcf5628299ccfdaa2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436489, "uuid": "5d695447-c87b-4ce5-a1ad-1d4af5399cd2", "comment": "Malware payload", "value": "184ffef3f26c526e1c31a7fca345a3684b11d84b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436489, "uuid": "7669e4f0-da96-486a-a0e8-acb009a101f1", "comment": "Malware payload", "value": "ce986805e9c3d0285d933ae7991913b0cf5e767d0c803d67f5f0285eea0f8c9135834bff8a8d5a951c3d3ce76db084ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436489, "uuid": "0570ab11-0121-412a-97d7-d176f0212d68", "value": "T18DE5238DBED23975E03BC7F7036319ED712937908AB14D8D36DA2B105E625296C3B34A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436489, "uuid": "2d5d30af-986d-401d-90b1-8f959087e99b", "value": "1799eb3c1092391ae174afa4eee4cba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436489, "uuid": "d01118e2-1f8d-4397-b6b4-47a0ed423251", "value": "49152:HMN1IqFSluyMPwqQh0hJZopPyjKz5b890kxpGfitJCqDRCRP76O3:snFSldMPwqQ+hJCpPyjG5b89bpAyqR+k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786436489, "uuid": "0df0284e-1895-4bc4-9deb-9529ab63d0e2", "value": 3047936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786436489, "uuid": "206be324-7804-499e-bb42-8d616ec029b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436489, "uuid": "3e10e032-bb53-4f9b-9d04-455081fe4f28", "value": "gM9anpOuZNKX8zHj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b34b8e91-9550-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786430926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786430926, "uuid": "bc43c57a-fd87-44a3-b8a9-74828d42ee9b", "comment": "Malware payload (Vidar)", "value": "247b57a63b2bbe0d690229e5b4cfcea6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786430926, "uuid": "633e8bad-7c39-4c81-b7be-eafdab5f3c19", "comment": "Malware payload (Vidar)", "value": "6ff3935d6215fc5bd0f6323430ee2e69da7b7344cb0f567ea8a91200ab414351", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786430926, "uuid": "e85cf310-9cee-4d9b-883b-15c48cc61905", "comment": "Malware payload (Vidar)", "value": "fe433d2ad1174bdfb1ce49392c8d714b01a01078", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786430926, "uuid": "e328c31b-192d-4eb4-8faf-0aa2894b6b3b", "comment": "Malware payload (Vidar)", "value": "1909d3478bdac7bb34c0cf17220add16ba7555b8fe4afcd76173ae66ba510c6b6d9a00d6b717f8feaa6665e58cae848f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786430926, "uuid": "5646503e-a768-450f-ae2d-ae25e771e466", "value": "T1DBF40999E5D113DDD873D636C308922AFDF83868BA30CAB5538219B45FA2F3475983C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786430926, "uuid": "2c5d4d79-9ac5-4f73-9304-b4dc3263d03a", "value": "12288:+zUf1/0DY3YUsdbXGinoMRp7hZzH9ZabDFzZkAl:Z/OYyb2in3hc5Z5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786430926, "uuid": "a9f818ef-fb62-4cd5-8f33-23f7eecf6388", "value": 777728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786430926, "uuid": "6e3d8dd6-7bb0-42de-8d15-cf9d7c3c898c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786430926, "uuid": "5824cc8e-1c21-45b3-b6f1-e768f9d1bcd3", "value": "14ca810daf0e2f39f91430a926ba057e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "876b2481-9552-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786431711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786431711, "uuid": "a96071ed-fb57-462a-b5f1-9c91986634f0", "comment": "Malware payload", "value": "055cbf32970ec3d0dd6e7a4545a67393", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786431711, "uuid": "f71e35d1-f3b1-41e3-88a9-b311bf9e8285", "comment": "Malware payload", "value": "7069a9a9d9e5d0ef2acb958dcd07785bf382430db63884381c991ae578a65749", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786431711, "uuid": "66a93824-a8b5-473c-b0f6-f6ec2b947037", "comment": "Malware payload", "value": "e602971ad6b5cf94baf99a1cea40062a87c851e7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786431711, "uuid": "1364499c-839c-4a29-b9ec-ec583e9b9f16", "comment": "Malware payload", "value": "adad97d1a0c39e7f3ca65937553bc67daddc4472da158db751d56a0e17f0e03ecc5aceb50d1e551b1599749ab77ff6d7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786431711, "uuid": "babb8e65-4bd7-45c8-abda-77eae9267e4e", "value": "T182236C551A857C249A98C4371D7E2F0CB9AD43E6321452EE7FCB3CF28C8AA9D920971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786431711, "uuid": "3d4c9cb4-b0a4-424f-bad5-eb1207976953", "value": "768:tVEJVIhtMn9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:DEJ2MQcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786431711, "uuid": "9fba6478-9c75-4ba8-a43a-981f3302331d", "value": 50055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786431711, "uuid": "dac09ac8-9924-4d08-94d3-ac158a273fe4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786431711, "uuid": "45602406-6591-4b47-8b05-83fbb9e1b2b2", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f27fdd9-958e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786457279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457279, "uuid": "cfcc619a-0a09-46a9-b7c8-1129f5e71890", "comment": "Malware payload", "value": "a751230d17e525ee7a83e20fdfaaf5fc", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457279, "uuid": "0d8e8bf7-3bb9-4985-8d41-588b7ac7f3c5", "comment": "Malware payload", "value": "70d7e85ab26cd6507cb75f7b5dfa3f35d302689c5ce15fe07d3d0c0fc0a64f23", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457279, "uuid": "7a34d6cf-79c2-429e-adac-59a9dbbb2127", "comment": "Malware payload", "value": "4bd6ce89652d986718c35cd875578b08fcc0434d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457279, "uuid": "e4cea535-875d-4446-bc6c-d80480267ec4", "comment": "Malware payload", "value": "78d3b3ea5725fbd57a61d6139e212f86294bba45b3e881369bce1993fe6a9f69c40153c4f0ccf2f182852196d5f5e8c0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457279, "uuid": "b7129c0b-39dc-481a-940d-c5fe990850bb", "value": "T183418CC900448A382CF29E6E31E98C58F3A1A0B720C1DF9694FB35F7404DE441E92EDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457279, "uuid": "116d2492-affe-4e13-9708-931c3742b5ef", "value": "48:v0djl0sM920hdhjZ0hvd0CGK01rv0Ygg0c860v5p0DVX0SWq0gYW03v35an:v0djl0sM920rNZ0hvd0CGK01rv0Ygg0Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786457279, "uuid": "f8b99047-273f-4b18-9834-30b071db4c91", "value": 2360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786457279, "uuid": "b2533f5f-f81e-458b-ac0e-d70d2ea762d6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457279, "uuid": "9ea57459-bd2a-420f-a695-634ad68a48e0", "value": "yarn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86606c9a-9552-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786431709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786431709, "uuid": "594aa3d8-6a33-4fe6-b62a-287d03e5d398", "comment": "Malware payload (Mirai)", "value": "320747c775cbf39698d8f60addc9ab10", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786431709, "uuid": "5cbc9d3e-ce2a-490f-8520-7bfbef5c1242", "comment": "Malware payload (Mirai)", "value": "722ef36773017f3e3453c80bc6dbef8c0cb3ed672947a7ce8dcce24ca77fe8a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786431709, "uuid": "2549db0f-bf3e-4652-99f8-81a0c35cb8b7", "comment": "Malware payload (Mirai)", "value": "02a6590a453d80d404c42a3f0c80fc0a11acb4cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786431709, "uuid": "e827a528-3a8b-48da-b9cb-1533507f8d5e", "comment": "Malware payload (Mirai)", "value": "a5e6fdcbf2627b7954bd6903bf806170c374556a15a66a9277dd83ae8fc8be70d676771b3843b4d4f960e8c7c43de935", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786431709, "uuid": "fd8bb8fc-34f5-404c-87fb-4e5faebe8538", "value": "T1F1E47E9DFE4E3C42E2D7E278DA4D87E1B22771E4D32391A37982434CD5C69D8CBA1921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786431709, "uuid": "34e9e8ac-0073-429a-87df-95f64daebb35", "value": "12288:9Aq4KHRr6n4Mq+WgnUIBsIUgUOZq5oiZ5Kny2YFBVMUcVFw5X4t8Z:9yYr6nbxshgUOZWp3vlcB2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786431709, "uuid": "a651203b-3c58-4330-97f6-840b72ee9528", "value": 710256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786431709, "uuid": "e49759a2-d0b3-44ab-bad5-6a47357d3851", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786431709, "uuid": "0d324fbe-09b2-4ed4-81d1-7d2c707adff6", "value": "data_aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5326f99-9587-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786454551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786454551, "uuid": "f3a27620-ccf2-4730-a254-99c4f1559dc4", "comment": "Malware payload", "value": "54f6e88000296aff4adfafcfbbb2f0d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786454551, "uuid": "82a2381c-f787-42e0-a228-95e2d7bbe2c8", "comment": "Malware payload", "value": "723b94569daadcca55ed8e481cb212c889042256b7100a09359e6a1547bc2fbb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786454551, "uuid": "8caa9cd1-6c80-4745-ba5f-cad7ef143162", "comment": "Malware payload", "value": "95e266ce7131a7378803883be1164e6429fcc6d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786454551, "uuid": "94b0a786-7697-4d62-9b98-c580d73cdc7f", "comment": "Malware payload", "value": "fca3135aaa275fdef173ea9e4b19f1ce8e9765162f7117828ff36f092e4c566bb5c968312459baf716ef3d6f1808618e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786454551, "uuid": "c667afb8-f046-4345-8a54-e4c8f40b78f8", "value": "T121736BC29C218724C2E613B857F94A5593E11F2236CB3301CAA1F739BD9E164B693D9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786454551, "uuid": "7ce6c79f-2159-4afc-9632-dd2bf5259087", "value": "1536:m16O0CQ33I6G/FBjQtq/5rdo+DzVJc/iz6A2xyLoTySoRQS0ra:5Cl6qFBctq/k+DEQ6A2xyLoTyjQH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786454551, "uuid": "026f5910-e6f4-4e34-afa8-ce93663cd5dd", "value": 79088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786454551, "uuid": "1d42de7a-631e-442d-8114-e6ddd3ac6f28", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786454551, "uuid": "16bb2a27-ce56-449d-a5b7-935b03621ffa", "value": "main.riscv64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62281013-954b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786428642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786428642, "uuid": "e1ad03a6-7348-4464-9987-766d1bc368eb", "comment": "Malware payload (Mirai)", "value": "11c0c5da2a6e0440a29ce424ba61c5ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786428642, "uuid": "28060fd0-dcdd-4825-b7d6-9f99755b6de3", "comment": "Malware payload (Mirai)", "value": "723deb8e80ee38b5c7004f410ecc764f23382b0cd2b9e86cc87b2e013eaa8bb7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786428642, "uuid": "9a3e5d88-eeda-41cb-8e01-fcf5035d01be", "comment": "Malware payload (Mirai)", "value": "312862f059439701e9d473d0c04193ac1262859b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786428642, "uuid": "b2f00374-fa33-46bc-9f48-1fd0e1d9b4e4", "comment": "Malware payload (Mirai)", "value": "abb7ae4c1eb9182b94af50fdb6664b4f9398c753ddb66fca1567e27862c4cb1d71c3605c841591ace22df3d68aa17610", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786428642, "uuid": "2b584b2e-d45e-40f4-849f-9274ebe18b4c", "value": "T169040A41F8144B57C6C22BBBBB9F439D37335B1897DB3301AA24AEB42F8679C1E29511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786428642, "uuid": "fa9757fd-e80a-4f0e-b674-18f4df427fc5", "value": "3072:TDfwbxgOGFc4wKdEJER2CRtRNHSFXBnOOvzBGwoUZaErar/nHUXD:yxgfFc4wKiJopR9HSmOvzBGwoUZaEraK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786428642, "uuid": "3363185a-d8b2-432b-aee8-fe6a15071732", "value": 184928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786428642, "uuid": "fac344bb-cc22-444b-9ea9-13f2d4707ada", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786428642, "uuid": "af89df51-1ad2-4b98-b90c-9634912b9bc2", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5781244-95a5-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786467517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786467517, "uuid": "48401263-36bb-4edc-af96-0a7a4308c3d7", "comment": "Malware payload", "value": "2f7012f7f89767751d11c3d8974f45ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786467517, "uuid": "162a7a0b-f4bd-4c50-8487-f3d1c779408a", "comment": "Malware payload", "value": "72b499839ac78ce34d804dbfbbcf1ed48222af1a5863058c44ecd87790d209bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786467517, "uuid": "75200e0c-bbc9-40e8-b8ec-cc5c41afd618", "comment": "Malware payload", "value": "addca146142809657d5cea9019702733e16f63b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786467517, "uuid": "c79fba72-5647-490c-951a-9e8bdca6f3f2", "comment": "Malware payload", "value": "1e60b6df930f591b8ce09b1fa1f385709cc4185b95aedb9d2119771ddd4413e00cfe00d54fcf4e339a93e0cb863d877a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786467517, "uuid": "4aa91242-fd63-426e-8e86-cbf8726c4833", "value": "T14E53E85BB5E3B0BCC287C0746A5BD5B2B93178B002213E3FA6C8FA312935D516659F72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786467517, "uuid": "62bb2f6b-c2cf-4769-98d3-e63c7c41957c", "value": "1536:vm+uBwFUIK2OA57Lp7xLz8zDTXpvJCuJORBNZW2qUr:LufIK2OA1p7xLd+wr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786467517, "uuid": "fbe43a07-366f-4b11-9ae6-3ce879c3c6aa", "value": 66640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786467517, "uuid": "8e8797d6-561d-4a4e-a75f-11557a48510a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786467517, "uuid": "9820218a-dab9-48f9-864b-73f93eca7bcf", "value": "72b499839ac78ce34d804dbfbbcf1ed48222af1a5863058c44ecd87790d209bf.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6afe4351-953a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786421356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786421356, "uuid": "97dff042-2322-49be-8bbb-9657065978b2", "comment": "Malware payload (Mirai)", "value": "55857fbd2e9fb4eacae225e8a8ab8263", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786421356, "uuid": "3b2080c5-13e8-4c40-9de5-3feac32f1cbc", "comment": "Malware payload (Mirai)", "value": "72e54d94c4663cea722f186c94910aa11ed12fd3535b9cce1f2f7301251432d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786421356, "uuid": "d8ea16e9-5e16-4130-a51d-6a8d88ef83a8", "comment": "Malware payload (Mirai)", "value": "877ca0c683120bafc58cdd17d55fc84376177d62", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786421356, "uuid": "337eaf6f-cdfd-452f-8a23-6cff336865a9", "comment": "Malware payload (Mirai)", "value": "11b605192b9877e3f391c763d5a9d2ebb805ee1eb8e603707142553c34b659ef1c731353417e959534509636bcc94b1f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786421356, "uuid": "b4106f37-a3a6-4097-bffc-26a74c38aa6f", "value": "T1115302F0B927DDDAC755DCB6950086E1F212FCD6128D2F2F017EA54E5CA2D0C6D3A990", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786421356, "uuid": "6f355ad4-96d3-49da-bd66-96224f8975fd", "value": "1536:CTcEpml2mXaFtXMXzf8ZaGalcuawZ1qK8Wkg:C4EK2mq7MjUZaGalcVwZcKBkg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786421356, "uuid": "07c6bffb-9193-40d3-a51f-b04006971ad8", "value": 63028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786421356, "uuid": "76bef270-0cfc-4cea-aca0-af84c8846592", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786421356, "uuid": "e89f101e-38ff-4763-b018-e8cb61492f28", "value": "putita.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af473ebe-95c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786482029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786482029, "uuid": "c70711ca-cab4-4b03-94ce-3a9157fc8112", "comment": "Malware payload (Vidar)", "value": "13e516717069a6dbb83275757d40a477", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786482029, "uuid": "f504cc6a-8cc6-4d86-b1e0-eed6a72ada6f", "comment": "Malware payload (Vidar)", "value": "731acbfa197b35c2db0a80e6dc028dec85bd385d43248dea91512e1e25e64d4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786482029, "uuid": "90d9dc71-1f2d-4853-8ee8-3e3d4f87b21f", "comment": "Malware payload (Vidar)", "value": "636fecf89f9f18f288b2219cc90896048908bed9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786482029, "uuid": "5a8ea458-627e-45ee-a0da-a4d8d8292635", "comment": "Malware payload (Vidar)", "value": "fc4803f69bc0dc44889e20ede717ffcf2cde8a7dcfaaaedbe23b57316586ad4d8cf383ca08a6203f238a4251bdf1dc7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786482029, "uuid": "1c0e01ca-6d09-4d42-896b-6f34d8d0c9e2", "value": "T151D59E077CD009E9D89AA63188F221867F35B8551F3A23D72E50B7782F36BE19D36790", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786482029, "uuid": "ef59dfc2-d4a7-46c2-b329-33fedcdf1b98", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786482029, "uuid": "2b06f926-2bef-4e47-bd5b-2f03079e2a61", "value": "49152:igiu70whea2sfAZx70707a7q7YW3LkQUqHr20lCp3g0ExT4eVEzp9yyvB90gp:igiT0+a0lK3HqseV890g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786482029, "uuid": "301870cb-03fc-4bea-91b8-04c85b99af00", "value": 3018608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786482029, "uuid": "d655d40d-bffe-4ab9-80f3-506682be05e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786482029, "uuid": "11963fe7-ff22-4023-81e8-bef5a60898ad", "value": "731acbfa197b35c2db0a80e6dc028dec85bd385d43248dea91512e1e25e64d4f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d61a4d40-95d8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786489396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786489396, "uuid": "fd5def5e-62a8-46bc-b103-8906083b4558", "comment": "Malware payload", "value": "551359043daa614c1a672e9d86342710", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786489396, "uuid": "9053f680-d995-4827-8a11-5e0e419cd534", "comment": "Malware payload", "value": "7328dab439d87aac1bc23c5f975040aeeaaf17db880f324a910bd3a48bba7553", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786489396, "uuid": "6cc642bb-79e4-40e3-815c-aed038b657d6", "comment": "Malware payload", "value": "cf642b66aa3ea6d947afb651b21845852be6d77b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786489396, "uuid": "cb2f77ce-ff81-4a23-82b4-fc8d600cbed7", "comment": "Malware payload", "value": "67436574eba866903f4ae78e171e0a36300d2eebff10102c52c546b805812d3ac0de41d5717727f83d172139a23282d1", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786489396, "uuid": "0c3badba-276a-4cd5-8e74-0a9b39105cb2", "value": "T15A0733BEF0D53B41EB4291FDC1F294029A15C24A1C50F5A0A8A252B64FDE65BF178F2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786489396, "uuid": "07bc5bd2-fae1-4574-96fe-d7a2fac79847", "value": "393216:54ArisP4vM+HZhBkVLLDv+xJzYgUxQsX8152VM3SELfLwuN:VZ4DH4vShbUxF8b22SEfw+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786489396, "uuid": "a4c2ed12-d7a3-4347-a4a5-7b888c2773a2", "value": 17873004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786489396, "uuid": "27940f5f-3c0a-4264-9799-95e78c1ccad8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786489396, "uuid": "18732385-a661-4b32-9df3-13baf4ebfcb6", "value": "browserbroker.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0a2c022-9543-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786425392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786425392, "uuid": "761594ae-8d98-4eee-b021-c3b3d210a88a", "comment": "Malware payload (Mirai)", "value": "f253bca2d32620bce829edd8869582f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786425392, "uuid": "4de1ca1b-a407-461c-8b24-dbd7b377b378", "comment": "Malware payload (Mirai)", "value": "734bb4d60c243a592738118bc6711c7da0b3f25679adddc42a02ae53e63dc1b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786425392, "uuid": "8c834ac6-8c9d-4b79-8d27-f32e68f8bc77", "comment": "Malware payload (Mirai)", "value": "c14fd958600330d14527855ca8bf74252fce39bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786425392, "uuid": "34ee9dae-f1b4-4b8d-a973-7976fc5230f9", "comment": "Malware payload (Mirai)", "value": "fd3dd17a5b9db3e886eb6200568f6a08b38cd1a2e553084ddc2883562b62645da0a1f73bd86d654f63ae59701c77a23e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786425392, "uuid": "ee805e2c-7cfd-4672-bace-be88c2edab69", "value": "T13AC32AA9F890DE52C6C52676FB4E418C33231778C3DA7105CE149E35E7EBD6A0E3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786425392, "uuid": "c5cbf989-4acf-4400-904a-3e16e235e9dc", "value": "3072:XzwQ+NP5wsYILWTC0vcYEEUpAUWrqORvLLy+XUULKYHlNlEwcB5hf1Dl:XkQy7AfvcYEEUpAUWVNLWCUULXSdfh95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786425392, "uuid": "a4fa0e7f-0b4a-4f1a-affd-cb38bc508bf6", "value": 128464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786425392, "uuid": "8f7c92d9-d55f-4de9-942c-a01d0f352590", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786425392, "uuid": "9d7e28cb-67e1-4eeb-b4ff-69164081d93d", "value": "putita.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4215663-956a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786442148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442148, "uuid": "62ff298e-796c-40ee-8885-890e146e8239", "comment": "Malware payload (Mirai)", "value": "04c17313325627daa3307f7ff444b23a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442148, "uuid": "cba56e0f-d814-4f43-b8aa-973700f2b391", "comment": "Malware payload (Mirai)", "value": "735f14c236dd7e57e6ca760988694db7911af7b05712f2665875567c7259ddea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442148, "uuid": "75ca0bae-981d-47d7-875d-0ff3d05fae5b", "comment": "Malware payload (Mirai)", "value": "d304e5fa56d34a969bab61ccb939c13f508423fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442148, "uuid": "5b3b9c50-21d3-4e04-a72f-428782dd72e3", "comment": "Malware payload (Mirai)", "value": "e5d88b50ff5991746a279287157f911f2f334577ab55abe69912b3def0fc490404dbbdc6a9c11198a92ea077e93427f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786442148, "uuid": "c26e5576-d4ed-4a38-a087-8c3dac07295e", "value": "T17D141946FC519B12C6C712BBFBAE428D372917B8D3EE31029D215F25378A45B0E3B646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786442148, "uuid": "a0dd810f-40e9-47cb-a660-a7ad28dc33a0", "value": "3072:toO2byE+gZkVSYmJgdnACVtmmLalybJG2bD3IZj:toZx+ckuGnACumLaus2bLaj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786442148, "uuid": "d22845de-2391-474d-96d5-0dcc56bcc70f", "value": 192472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786442148, "uuid": "1ce4316c-8bfa-458c-aedb-a0f2c4d66234", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786442148, "uuid": "4270fe2b-8412-4368-aab3-0dff178fd3e8", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f33b196a-95bc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786477419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477419, "uuid": "509102c1-1a01-4972-9ad0-ba1ac7cf02f1", "comment": "Malware payload", "value": "6cb01e34d065951158810e2d1939fbdc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477419, "uuid": "b30d7fcd-7a00-4340-ad3e-9c46b904782e", "comment": "Malware payload", "value": "738a2fe1012eb3d25f9a0e4c340047d887343c836380218bf2aa7093d95e3589", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477419, "uuid": "43244a0f-9824-484b-8b70-14a9ba112e1a", "comment": "Malware payload", "value": "795be7a37603d1d6a7e7fbaadaeece36f208f0cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477419, "uuid": "7a78ed49-faa5-459b-8948-f94d75e130d0", "comment": "Malware payload", "value": "b24d051927347a5c14aee7931fa2fcd52fd820fe5ef4830614099a5b07ae33ab8cd827c90a12d5e322b1b5b34098ac87", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786477419, "uuid": "313435d3-25ed-4f3b-bf32-e1a97e4d6bbf", "value": "T1B1131C13DA66C02EC84BE1B15FDFD6299933B87A1335A006B7A0FF606F459C0EE65253", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786477419, "uuid": "75e012f8-731a-4a9d-bff6-cb13f083c4eb", "value": "768:Tupm1P1XiTz++T52lWRv66EMtFmgnyguu1gHHgEb8TiQ5kwZvMy:ipm1PNif+62wRC6Ei/ygPe/bjQiwZvM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786477419, "uuid": "613d1317-db60-46fc-9824-1d666d041d8f", "value": 44664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786477419, "uuid": "ea665ff4-a032-48ea-a53e-d67991e0f142", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786477419, "uuid": "cf84a12c-f098-4f4b-bb00-cb08f219c97d", "value": "main.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29abc92c-9562-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786438426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438426, "uuid": "ac8eea34-6476-4177-af43-640aaf14342e", "comment": "Malware payload (Formbook)", "value": "b0c2e0d1e94c4c6eedf917516a05f8ee", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438426, "uuid": "74d41443-4cfe-4029-ba75-844db6428c6c", "comment": "Malware payload (Formbook)", "value": "739636a908792585013c3214143717a9b0358b1a9fce37e57798bf164f29b84b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438426, "uuid": "842d6f76-74a5-441d-9aee-a98e20fa3a00", "comment": "Malware payload (Formbook)", "value": "729adc7095e274607dbf4bfd4a6a3fef22f6a08f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438426, "uuid": "156e35e6-6890-4d49-b646-328cfa3e564b", "comment": "Malware payload (Formbook)", "value": "d039eebcdccaf133cf14755184ddd76bb2f7508cd08305b3eea4f6bb152016ba8b20bd64997e2506fc5fc0f5da20e19a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438426, "uuid": "36319df1-4747-40ab-9b02-846aef916d54", "value": "T182D3444A9ACB38445337673FA72AACD4EB3607A700500907F47CA696AFF1D16D9E0CB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438426, "uuid": "319425e3-1dcc-4230-8111-1ff8e659dd91", "value": "1536:4nMGBuqUktUQ7iodi5c0i5lp09C5+F1KVEgtQtjZ2zgGdNnAch9XXfL:kMGBuUU+jqH1KVEgtAZ2fA+9T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786438426, "uuid": "4bd20d2e-bbe7-41fe-bc31-f8d6c30d14e0", "value": 134612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786438426, "uuid": "54f9583d-2bc8-4b7c-8697-c31a7b73277f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438426, "uuid": "8d876b31-8bd5-444b-90e9-56613a2df49b", "value": "C-Invoice-PackingList-COO.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78537d82-95c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786480219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786480219, "uuid": "2fe5c8a6-a963-4a7a-a420-f6ba01c8e896", "comment": "Malware payload (Vidar)", "value": "20e73d0c3d1a0fe71d0542e6bba6412e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786480219, "uuid": "9cf3ee5b-2343-4d87-8909-c7773aa5e5f9", "comment": "Malware payload (Vidar)", "value": "73c4d3c0e58860b82a9123f3ad370bc2627fbd2a2445e7611c01d0abc0fe0370", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786480219, "uuid": "7fcd5543-4d7e-4507-a2c7-e6ef45926f9b", "comment": "Malware payload (Vidar)", "value": "67c18f0cb04203037921819d28b7d75a09d20873", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786480219, "uuid": "6a34f959-30a8-4284-9468-3648926cf2e3", "comment": "Malware payload (Vidar)", "value": "6c1c663efb613ed49915a102cf70ded23df8ce6b3e23257e91a124cd556b8ac842690e598b9c4ff1a08ef65b2742a8e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786480219, "uuid": "18c80d88-450c-4d7f-ba3c-5f1426e62b43", "value": "T1B1268C87BEA168A4C0DFD235A8AA02597B7DBC4D4F3623D72D50B67A2E363C14935F04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786480219, "uuid": "26b4aa0c-5bef-46ad-bd03-60bfac26dfe1", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786480219, "uuid": "dd5dce9c-b141-4695-8f18-e6640c6611d2", "value": "49152:0k8iFE8WfYwLLSak/UDAEiYfovdGc/xuZqs7XD1StNG8jG6CPEevmQuQ:0BwUDAEi/z/saHGKGgQuQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786480219, "uuid": "40e2b8b9-971d-4a03-96c2-c38cbee26dc4", "value": 4754528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786480219, "uuid": "cd8b046d-6eae-44e2-bc70-5833233903b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786480219, "uuid": "5552d95a-4a7c-4148-b920-cc4e6c56ffaa", "value": "73c4d3c0e58860b82a9123f3ad370bc2627fbd2a2445e7611c01d0abc0fe0370.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93ac2ac7-95c4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786480694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786480694, "uuid": "4333931a-3bec-48a0-a4ed-a12f759be526", "comment": "Malware payload", "value": "0e6a1e4d783f143ef770b28f3b8e9bc5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786480694, "uuid": "9b888b2f-7166-4f0f-a08a-3e4d4e16a57f", "comment": "Malware payload", "value": "745b0eab8dcbc5a6aceb1b8a81029fa5ce126400d8d2b803ec845bd09dac372e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786480694, "uuid": "63e69acf-368d-4d1b-90e0-607f2136f59c", "comment": "Malware payload", "value": "5830ffb479287d9c7923ea179761df6dcf716932", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786480694, "uuid": "30d6fc8f-2057-404c-8b5a-5987880f0065", "comment": "Malware payload", "value": "139e4f4b75741a72763416fc14dca8077ecdd75a8633a8165d726cce632d47914b9789ad24396e1e0a0c21ccb669610a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786480694, "uuid": "8e73ca65-d7c8-4828-bc5f-c2bf541d791c", "value": "T19D13C647672E0947C0772EF03A7B27F087AABDA212E49540565EFFC14235EB06152FAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786480694, "uuid": "82e8b5ec-e4f7-4574-b911-1ced37821a80", "value": "768:nyS1xTMO2iXOy485FdmnxzXNsFADweTZ5555555555555555T55555555555555m:yYENCgnxiAD9g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786480694, "uuid": "6e328b21-7f57-4f79-8ba7-29626d13cf3f", "value": 44604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786480694, "uuid": "fc42975c-3797-426b-a787-620e7eb83657", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786480694, "uuid": "5f38bcf2-c7e6-4816-8b51-047fafb58426", "value": "main.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1dd38db-9588-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786455056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786455056, "uuid": "179d16c3-ded0-44c1-bc35-9fdbdb23cc88", "comment": "Malware payload", "value": "d45ae110a75922c54061a9e969017435", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786455056, "uuid": "ded492d1-a188-473e-a9e1-b0e95c3e111a", "comment": "Malware payload", "value": "745c68c87b6ff7b98fe61a2aae8a9438e231644934dcf1773658ffb874060ba6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786455056, "uuid": "1f928d8e-d0a3-4c53-9435-17c7bdbbc827", "comment": "Malware payload", "value": "7b5f1986879c8e7134a50a2c8b24998d7f13b708", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786455056, "uuid": "2cfdbc04-3e23-4284-be79-c1f97c79ff74", "comment": "Malware payload", "value": "91b2af4e7b6b4d0c6e5a0ff1a47312b6ed1cf9a729dbcb0abc091dfab05187700ddae193dda0f2976b9d2cf2229ab9f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786455056, "uuid": "935613ff-2969-4f45-b102-10e7ac02b088", "value": "T185D318177A271D22F4D11135A2FF03E2BFE683CB25784EA7B65109C5AF276A074832B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786455056, "uuid": "eb55e407-1875-45f5-bebd-baa338a0988f", "value": "1536:pNKs0o7JyDHUlR5umkUyVFsHm8mZLtdQtI+n5p5L1lP4:pN/hdoeRUmkUysSdWp4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786455056, "uuid": "cdaeda98-072c-4172-a52a-97b0dced4020", "value": 132480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786455056, "uuid": "9f3bb319-9dc1-4db1-acb3-e2f66641fc7b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786455056, "uuid": "bdd4713f-e65d-4f50-bc9e-4c5f09f32d83", "value": "main.sparcv8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab4b450f-9533-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786418457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786418457, "uuid": "699c657b-b2ff-4b8e-bf26-d218b7a57ec0", "comment": "Malware payload", "value": "050d09061116c1b62b23b6e8f6d49f76", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786418457, "uuid": "304a19a5-9259-487c-98d8-f7a5f57e612b", "comment": "Malware payload", "value": "74d5d6d4a670fa609f2f5b1f62ad79a06bd4a04a98e563e8b6e339398ed8d158", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786418457, "uuid": "ffc1c09f-b1e0-433c-afad-517fd9a37150", "comment": "Malware payload", "value": "656b7f6fa9baf66e729c5b8110b767e7b568d957", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786418457, "uuid": "4a13e34e-ec08-4ef5-98f8-2adceca08266", "comment": "Malware payload", "value": "091f760e24f850882489097b57f96283601a83ce86a4aa4a5c5828577b2ff056a7a5ed783a60181d8b2d46a5290e1ca4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786418457, "uuid": "823a6538-74ea-4a1d-ba7e-7f42ffad4694", "value": "T13B236C6516857C14AA98C4375C7F2F0CB9AD43E6314492DE7FCE3CF28C4A6ADA20871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786418457, "uuid": "b89e3f57-86be-413e-9c93-7664f195ea1d", "value": "768:l99NyXsZztCu9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:zHusZicr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786418457, "uuid": "0af17e33-3d5d-4b0d-a6d8-ab97472117c2", "value": 50071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786418457, "uuid": "6925a85b-d433-4bb8-ad3c-a04a6aa4c941", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786418457, "uuid": "2174df2f-27d1-4419-9c96-c82fd5ac4707", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41312cfb-959c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786463376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786463376, "uuid": "a1b9824c-9a24-4f72-b7fa-edda8c24e1f7", "comment": "Malware payload (Mirai)", "value": "0b187ffad74d6579d14dc4b28003ce42", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786463376, "uuid": "97d7e978-baae-442c-b68e-ad271721380a", "comment": "Malware payload (Mirai)", "value": "75105a85b401b69e5f1f3ffdde75f58017a807af906be34fd3b54ec6a98d1386", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786463376, "uuid": "b993fafc-16be-446b-ba6d-f09e623b3986", "comment": "Malware payload (Mirai)", "value": "f7ad011b64f27ecc43a30631c6f0b863aaf40dd7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786463376, "uuid": "c8058d0a-d15c-499c-87b2-1f93c9e44aad", "comment": "Malware payload (Mirai)", "value": "7a12262a99e878f1f15ace9b77d001e6b6a3fc957b645d77f65a7b9543442055e5a4fba3f6d60135bceb2a6e10fc5baa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786463376, "uuid": "7afdc87f-1a76-45e0-837a-2cc3eed98e7b", "value": "T1E153C595F882992FC1D1033AF58E7B8E3B2573D492CE7613DC614B613B8A29B0D56F90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786463376, "uuid": "8b222a9e-805f-4d9c-9a59-03229cd211b0", "value": "1536:y5JtBeanXoaYHhJnp8Vgk1GXUEUdBoCl6L:y5Ne5BJnp8VjKR4/l6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786463376, "uuid": "50035dab-140b-40ae-9a36-2ccfa8982323", "value": 62984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786463376, "uuid": "2febcd08-3fd8-4a36-8423-8c664e7a06ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786463376, "uuid": "8cbb4305-d6d7-403e-88dd-104ddef41505", "value": "39db9469183655f73cb9c7639af70b104fdbaf65bf68ce69a55be0010c5039de.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eadd0605-95ba-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786476546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476546, "uuid": "6b79aad8-fd3b-471e-ac41-e7ff4f4b26f1", "comment": "Malware payload (Mirai)", "value": "0b996694633c5d318541352489c345bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476546, "uuid": "22bcd57f-610c-4a62-bee8-9e39fc1db73c", "comment": "Malware payload (Mirai)", "value": "751cb22b7c7211ff40dfbd0a66b17e07a958bbbbe03ad2fa5406a1478e84a9ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476546, "uuid": "9ffa4aa1-61c7-4268-8106-460d775d2bf7", "comment": "Malware payload (Mirai)", "value": "a3c32b9ee51a06042330927c349bcc8bf9745a91", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476546, "uuid": "3e637ca9-0445-44f4-aec4-d40d1bdc7d54", "comment": "Malware payload (Mirai)", "value": "c75e2749f0790684cc22a47282a9515c7f9641a7efd6d8d0b87c79117740a510773d3b2e8db77ed055571f860212bc4c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476546, "uuid": "5381d4b6-dd60-4b16-b1ef-1a83fb1dc661", "value": "T12BE3394ABA805F31D5C212BEFA19D14C33237754E2EF72125D199B419ACAAAF0F3790D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476546, "uuid": "0311c5dd-20ea-483e-b1e1-ba1318c57e65", "value": "3072:1/6VF8FSibWJ1tK2jNpcB2gIAVSkYXdK1cQ:1/6V4WJ1tK2BpVT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786476546, "uuid": "2372a855-132b-4488-b755-81a354b5b411", "value": 145760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786476546, "uuid": "aeb04866-164c-4cae-a77c-43e7f5910c9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476546, "uuid": "e9c8fade-d08d-4ce7-958b-901a951d882d", "value": "mirai.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b6f372a-95bb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786476842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476842, "uuid": "d6f29678-c0b7-4fdf-9437-98152f167387", "comment": "Malware payload", "value": "98ba2d91a4d3e50ea1d7daf55d349f32", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476842, "uuid": "60827e61-f6f3-400c-9199-4d8eb5c86d54", "comment": "Malware payload", "value": "7523c9f9c12d73739640928d548f66b36f1aee2dda77a556cb232e550773e184", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476842, "uuid": "93aaabd6-3c34-454c-9c5f-8616f5eec635", "comment": "Malware payload", "value": "9a9f66e421a2ecb683f13e02235db7f7e2ec5c9f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476842, "uuid": "b46a311e-fbbf-40c7-b5ef-237c96956ad4", "comment": "Malware payload", "value": "8ca763daba2296094f74fa5670cac9859f37091d2264737fdcd43be213e23348fac5c951d89b2d5ae4b357d14e459b23", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476842, "uuid": "6c27ff3a-d14a-4e47-a413-5c3fead97830", "value": "T196237D652A817C14AA98C4371D7E2F0CB9AD43E6320492ED7FCF3CF68C5A69DA11871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476842, "uuid": "b9dcb732-5d4f-4cbb-bb35-aaab5ba802ad", "value": "768:2XOGVvK9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:YLHcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786476842, "uuid": "53e5ddb4-8c4b-485d-be8b-14894b9849b7", "value": 50043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786476842, "uuid": "8bb86fcc-9ab5-4a9a-a0af-33e29bd7ecd1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476842, "uuid": "7f70f2d1-6d6d-4a9a-945c-d5900284903f", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22680b05-9562-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786438414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438414, "uuid": "816e80ac-3354-4f03-a6bb-f689b768c242", "comment": "Malware payload (Formbook)", "value": "5a4a2688861d5c919ab6bceca9c52e36", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438414, "uuid": "cecdee8f-6f16-4b9b-aca5-44aae2c9340d", "comment": "Malware payload (Formbook)", "value": "75896cc1dbab79bb850e0ab027ef0e01531ae53e473705e75ed6fe2db726929a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438414, "uuid": "a36e13d3-41e6-4ceb-a7f6-291ef281bdf9", "comment": "Malware payload (Formbook)", "value": "d2234d5001ba4f62ffd40b60b745976e118ca9fc", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438414, "uuid": "6ab629bc-4068-4013-94ea-efce0afb91b3", "comment": "Malware payload (Formbook)", "value": "8c9c0d06bae90c119041b4298ea581bdb470376f7e4e9a93e2d2fdb331f6f5fb08d05da649c3d277edb9de29867e4f28", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438414, "uuid": "9ea8f7b7-2a95-40bb-81ee-3f6b503d612c", "value": "T1AF53CC84559329885737BBAFB32A98E4F3B617AB01914D17783C6450AFF1C09DDE0CBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438414, "uuid": "0094355c-e1a4-4f40-b8e7-1b7cd71c9b74", "value": "768:u6w5BZLp8F+lWUH3djkLqnZmSsKfKeiypu5qFux0Xrvomrp/WNs0q3mQfwxSvbxL:85ODJ1ePj0A8cm40E8OsXRO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786438414, "uuid": "fd0a844e-f960-4f5c-bf75-c0f7c66016a8", "value": 62292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786438414, "uuid": "6066d272-49a6-42cf-867a-e0f263ae733f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438414, "uuid": "5c125e54-8d09-4202-96f7-88df25450a6d", "value": "Draft-BL-MEDUxxx862.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d51e33e-95dd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786491260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786491260, "uuid": "2cd5b707-908f-4b24-8db0-a34386405f2a", "comment": "Malware payload", "value": "400e4b330f3387316b02dd22f7e35909", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786491260, "uuid": "bef3aa59-c71a-4250-a4d2-76d62fb12976", "comment": "Malware payload", "value": "75caab85154c97165c28387ad6899a0f82e61351a74095e699926344468b8d69", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786491260, "uuid": "839bfd0f-0242-4ce7-8139-4a6fff4f7973", "comment": "Malware payload", "value": "fc8ee17f94995c08b53274e0a4e495334f2dbba6", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786491260, "uuid": "ffdad7f4-2fcc-4aa6-84c9-90986fd8eb7d", "comment": "Malware payload", "value": "21f511f4599daac18c2d59e27501a2f4a4c8bb7b7aeb83593e6db416ab18d2cce417eac551b1e7a99e117c364c8d19e3", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786491260, "uuid": "d728193e-a70b-4d32-91ec-bdeb0ab12f64", "value": "T121173392E0CD871DEC5FBEB9B21885BE212FE8C7614CBC0B0D0AE755EE02415677999C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786491260, "uuid": "e4ed872d-a6a5-4453-9e95-e0b360acc971", "value": "393216:T8LzCNW1akeQKDERyXQZS5GSJe4JflNhcB+eurQdTgtaDBKFBT6x2v:T8nKWgk7mEU35GShJfeEeuEdWUByBT6E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786491260, "uuid": "575e43eb-3f66-4345-90a8-ddaa8a57753d", "value": 18854622, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786491260, "uuid": "acfd56af-347f-4ac5-a1b8-0102f0b011ff", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786491260, "uuid": "6e4f2515-0d7d-47fa-bb95-60308725730b", "value": "dmwmicsp.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "259f2d3b-9569-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786441426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441426, "uuid": "d7637525-3621-439e-8a50-79b2e8073524", "comment": "Malware payload (Mirai)", "value": "2d04a37d22c4c74917fbd3c5f365177c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441426, "uuid": "cedce5e3-7547-4efd-aed8-d616c01f73e3", "comment": "Malware payload (Mirai)", "value": "75fa2cf5063c2062c4658e3138ca9e30e4ac46458b29fc6a7a3ec214ce7d4dde", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441426, "uuid": "64636bfc-5466-4adc-bdec-26a928216899", "comment": "Malware payload (Mirai)", "value": "68cb175f60ef117f20c185042c1f5529543a2a15", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441426, "uuid": "a75b4ac2-2b56-4d0d-91ee-000a1c7920aa", "comment": "Malware payload (Mirai)", "value": "a852f594a3ceda846c95992c69087c9795b0cdfcccb50d3ecd3e0905c173c587a6e0d99a195bb31349ef4cfba9d46f13", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441426, "uuid": "b9d5b5c2-9a2e-411f-90cd-1cf1386f1553", "value": "T19CF37D80F353E2F6D84704B0617BEB339A359566511BEDC2D374DF36EC62902CA1AA9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441426, "uuid": "cb819a8d-dce4-40e1-a506-8084e3ae2fb9", "value": "3072:pLIxaXdi+Q3u8nk+jxhaXZX7ReY2aSDIOQP5Q/K+:pLIxaXM+W9k+jCRB2fQP5IK+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786441426, "uuid": "7b49f2b7-fce4-48bb-b85c-e669acbf195c", "value": 159360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786441426, "uuid": "424ea1a6-49bd-42cc-b675-78737e3a675b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441426, "uuid": "52933264-e718-4292-98c6-7e32b1b9d2f9", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af011678-95c2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786479881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786479881, "uuid": "da175cb7-600a-48b3-8b0a-6db21641bd83", "comment": "Malware payload (Vidar)", "value": "5bf00b0e72ad88dcd1319099f777beed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786479881, "uuid": "ac695e3e-88eb-4f68-9bae-6a570fbb31f8", "comment": "Malware payload (Vidar)", "value": "7689eccc807c883271ed6a519b4bedc39a32329e169e5f0385fd7ae8cf287637", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786479881, "uuid": "8171d9c4-8a68-42f5-a501-8e1a2a19d7ae", "comment": "Malware payload (Vidar)", "value": "f1ae95d2f65eda4cc38da1e65657cb45696fb4a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786479881, "uuid": "9293a01c-808c-40b8-8f2a-148bb864bbfe", "comment": "Malware payload (Vidar)", "value": "51351d971a6c5d3e7fd153f976cced89e31367d8a0f91daf2d1907489fc572f2953742734218f7f86a73f0a071915b9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786479881, "uuid": "8a13e4ec-be40-492b-a1ae-bbe3a5a4527e", "value": "T1C9766B07BB520E34D59AD735C4BA42226A607C5DC7353FAB1E11AEB43F293E19E38B14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786479881, "uuid": "3dfe6159-6a3d-4e98-947b-1e0a3357ea7f", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786479881, "uuid": "cae97053-4063-4276-bed2-8209c17c178c", "value": "49152:PFmtECNIZawPOEKT+YsIdHHK6JZMecj9tvBdhByIuvK/sQJzjVr+WpI7zUQnC3w8:PI+CNgINBiGcNmHLgU3wwMUQUm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786479881, "uuid": "20f53cbe-a214-40b4-b045-05f5e3312a9a", "value": 7664960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786479881, "uuid": "b4db5741-edd3-43a7-bb5c-4307c86f706b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786479881, "uuid": "2b5f98d8-5614-4210-833d-ebbff458cd82", "value": "7689eccc807c883271ed6a519b4bedc39a32329e169e5f0385fd7ae8cf287637.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d42d489-9522-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786410998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786410998, "uuid": "63285c19-085e-4c96-a492-ba51c0fb90f1", "comment": "Malware payload", "value": "8732229973f978d5de065eb0dc35e146", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786410998, "uuid": "9b8e99cd-a71c-44d7-a54d-44197db24d18", "comment": "Malware payload", "value": "769f8ef1aa8c84e8735445711584e227afc0abf677ff93333421af061a9559e2", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786410998, "uuid": "28a837d1-4419-4cf4-b323-7c6931011f49", "comment": "Malware payload", "value": "797440c1984b2998b30e69167ecfb5859248e8cb", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786410998, "uuid": "402ba0c3-20d7-4875-91bd-a8558a52d17f", "comment": "Malware payload", "value": "1feb9198e3a8659e57be448dfe0aed80bf1af040ca8449d314f5f1544c3ab3f27f6af7b4c4689f07c34bd6ffd50a5a48", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786410998, "uuid": "ec4116f5-d7a7-4ca3-83f0-5b1e4befaf0c", "value": "T17908AE15E3E40616D2BEC27CC6628603E6F0BCD75311CACF0459DA992FA3BD15E7B262", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786410998, "uuid": "2312935d-e76d-44af-91de-2a1f60e545c6", "value": "70d2e884fa127843c5bcbb53da86b6c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786410998, "uuid": "f26815bf-0c26-4bd8-a741-8b1bbda2109c", "value": "393216:z115a0XXvi5L5OtsFjhweJWBJ7sxXJDCtkJ5Wz3lzYqN9vuc9L4Jkn27UuWqGC33:wcXviV5OtsFjFg/YDoCkPR5to8tfbxOB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786410998, "uuid": "1a2c0707-4845-4b37-87b2-9537ba9a7656", "value": 78512261, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786410998, "uuid": "7913ee24-39ba-4083-841e-cfe35803f5c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786410998, "uuid": "bc35dac6-87ab-4637-a642-f8f9e320a03a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "518d84ef-954e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786429903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786429903, "uuid": "39cba811-2512-4315-9867-d1a7a9f7aa6b", "comment": "Malware payload (Mirai)", "value": "c2237b83d38827de24fd782fcf21e574", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786429903, "uuid": "91667474-9f77-42e3-bd2f-35fb51f0313d", "comment": "Malware payload (Mirai)", "value": "76b99cc042f9571e7c6b44c871a0164cb890768908e1f28303710f917fb5c541", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786429903, "uuid": "587c8733-f15e-47b6-904e-600c85520689", "comment": "Malware payload (Mirai)", "value": "d79fbb6e2329c2a9badb5b01e4d3e76ec105949e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786429903, "uuid": "9c977102-dc33-4597-b83b-a63d40cae826", "comment": "Malware payload (Mirai)", "value": "335ccadbcc297efb29159be40a4d5d011aedbd07e8d423691892d91becea870a8ea90311dcc9b83ed89c09174b56c5dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786429903, "uuid": "eaca3213-6f2c-4616-90f0-6d25c6490d32", "value": "T189D31956B9528B12C5C321BAFB9E554D33137FB8E3E932029D24AF60274B8DB0E77512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786429903, "uuid": "d13bd645-2258-4b82-9ff5-e552973aa79c", "value": "3072:+pjBwOsZDRQQXuS+q8cVNoBkKT+RafTm5mVFOwg3Vd7A/xu:+1BwOspRbXuFn4oaKTKaa5WOws7A/xu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786429903, "uuid": "d57a68b8-2d04-4d81-a036-e11176c90205", "value": 135632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786429903, "uuid": "d5fec337-10c0-4444-a75c-3260e12a5306", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786429903, "uuid": "cc3ef908-9b73-4afa-a6b0-7241d4756bfb", "value": "data_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19d9600f-95bb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786476625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476625, "uuid": "835a36b2-afe8-4b3a-a480-2a19442c8900", "comment": "Malware payload", "value": "8f14f7d816373d80b48524074fe017b0", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "unattributed", "colour": "#1869C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476625, "uuid": "c70963cb-899e-40b1-95ff-11d8518d29a7", "comment": "Malware payload", "value": "76cecb59150c715192f20922dd0e1fa6b2946f4f692ee82ea611d174c1da5433", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "unattributed", "colour": "#1869C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476625, "uuid": "de6be2f9-7bc8-4a24-8ce9-89781e116e5e", "comment": "Malware payload", "value": "04d97245b5be61d929f0fa5944bf2facb1986be2", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "unattributed", "colour": "#1869C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476625, "uuid": "b6ce4ea1-7857-4b6d-a3eb-99a4da4401cf", "comment": "Malware payload", "value": "728e44ef92098d40937c8b1d66c34addb8e58159ace5ea9bb8584e7a5100d13983c223455f9f7735b7c2cc20a4985dfe", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "unattributed", "colour": "#1869C5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476625, "uuid": "df9f9ab1-f43b-45cc-bd65-9918fe4e1b54", "value": "T1B3B66B113B95C42AF9B6117C6D39AF48056DFE22177050DB938436AE0F32AE36A3935F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476625, "uuid": "824ac0c0-81e6-405d-af8c-7dd3f566bd23", "value": "2c0ee08cba66b618a5c40e0b93e5218e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476625, "uuid": "cf51ca05-ad1e-47b0-9b84-93d18d9429d3", "value": "196608:J1Qyev6IOB+1vL2FsnbfaR9bKv1lOYggJ:J1Qyev6IU+l2Fl9bKv1lOYgO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786476625, "uuid": "29e16fac-6062-429e-be99-ac4be3837f2e", "value": 10646120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786476625, "uuid": "8850f539-f429-4d21-9e00-7d51a535f18d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476625, "uuid": "5e408efe-2efc-4b98-b386-f5f382f14798", "value": "76cecb59150c715192f20922dd0e1fa6b2946f4f692ee82ea611d174c1da5433.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36a3c4c8-95a5-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786467224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786467224, "uuid": "42dd8424-dfc4-4022-9f16-cf6cf3b988cc", "comment": "Malware payload", "value": "040311c953152cec8e5691284590c138", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786467224, "uuid": "cf24fef9-5f3e-4c56-932d-388fa44203ff", "comment": "Malware payload", "value": "7755ec9ce00ddc8953e8050186dcc74170a6d6f6865a4169c1cd7bbd4ab01ca5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786467224, "uuid": "c4bc3ea8-cc6f-4acd-a67e-706bf9dcc4a8", "comment": "Malware payload", "value": "ce86dd17bfa44d8c83dd16b9278facea1eb59ba5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786467224, "uuid": "a97d3772-7682-4747-95c6-4877d71ab1e0", "comment": "Malware payload", "value": "e39cf19151b7acbd19568281136055874dedc62b04d673b5fcc308d54d6e991bf1cae41415d02d14652a55980cf532e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786467224, "uuid": "57ab96cd-e6e8-4663-bc30-56c80de904f6", "value": "T18A53E85BB5E3B0BCC287C0746A5BD5B1B93178B002213E3FA6C8FA312935D516659F72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786467224, "uuid": "3a488c3f-5567-403c-bf11-e4668924554f", "value": "1536:vm+MBwFUIK2OA57Lp7xLz8zDTXpvJCuJORBNZW2qUr:LMfIK2OA1p7xLd+wr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786467224, "uuid": "20d41217-1a8a-4d6e-abff-dc34e7d26366", "value": 66640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786467224, "uuid": "ae3fe979-60bb-4112-bec7-427adb9a1584", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786467224, "uuid": "ebf9a6ca-0b7d-4d20-8f4b-50e64333c4e1", "value": "7755ec9ce00ddc8953e8050186dcc74170a6d6f6865a4169c1cd7bbd4ab01ca5.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b16e99c0-9555-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1786433070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786433070, "uuid": "33f31830-eedd-4390-9212-37da6c05cdba", "comment": "Malware payload (CoinMiner)", "value": "4e1b1615671ae37ba7b61886055f4908", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786433070, "uuid": "c0429f99-93e1-4e27-a320-70526e611a39", "comment": "Malware payload (CoinMiner)", "value": "7761a32cbc96fb28a0c4268376e52819fa8874724ade80b1a20be9ab38d8ca12", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786433070, "uuid": "36c613df-96fe-4afc-99b7-237b7afac953", "comment": "Malware payload (CoinMiner)", "value": "8aa20f09b9301325eb3e4a107fa5c1da43355bf1", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786433070, "uuid": "185da6e5-4039-4e1e-ac15-91ab360e155e", "comment": "Malware payload (CoinMiner)", "value": "4a41a10525726459593747aba3e1f06ca639a487d3ce1c410931477e6af2ef84bef3032d1b6433fa23d5d75736a983ab", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786433070, "uuid": "bb7a94a7-4b5a-4187-a794-8c3faf166ef6", "value": "T11F654B07B6A744BEC0F6C430874BC5B3AD35B8556225397B3685AB202E77E204B6DFB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786433070, "uuid": "02e41d7d-962c-4e66-bbc8-4a3c787e2535", "value": "24576:T4BO3vHiWykk/uOlmcXQdbmsA+9qGMUW0bhnPTW+/ONpRh:MY3v3e/Lda0+9pWOhnqR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786433070, "uuid": "ac8eb4ab-7b94-4265-830e-7ef7d281ba7b", "value": 1516416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786433070, "uuid": "b3d7d041-57d1-48f4-86b3-88d4c4112fe2", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786433070, "uuid": "cbe4865c-aad3-4ff4-ab15-e36ec5f2c9d1", "value": ".X0-lock_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d36a4ff-95d4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786487529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786487529, "uuid": "98fa13be-d63f-467f-9eae-e54ae97b4f36", "comment": "Malware payload (Vidar)", "value": "c3d29f810938136c3b9a4129ace70927", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786487529, "uuid": "7473c345-eda5-4a45-9723-156aecded575", "comment": "Malware payload (Vidar)", "value": "779d5a88e217ff32e029d08543f76dd0513a660283db1caa567821c45d64d3ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786487529, "uuid": "e8644810-e5cb-4fb7-9342-531f22c15182", "comment": "Malware payload (Vidar)", "value": "5f3af22cfd8fc26572bf02eda8cc83e931565181", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786487529, "uuid": "76302bae-5542-4b2f-b644-6ff69a39ed41", "comment": "Malware payload (Vidar)", "value": "78c082fab0761bbb34c2831780b81eb79393b8bef8ad49c3aecb8b124223b37f86717acbe2c46ea3c5885602f218d948", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786487529, "uuid": "b28cb116-95d7-47b7-a94d-84510a90c5b0", "value": "T1C4566C07EA525E3CC4E6EB3491764251BAA5780897393FE32E50AAF03F7B3D15978B01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786487529, "uuid": "191d7b83-98d5-40d0-92ed-d4e50fead170", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786487529, "uuid": "94968241-0a09-42e7-97e2-a698c22eaf63", "value": "98304:TH+PN9MWArl/DTnM/yMk2WQs2um7GHQlhcEQ:TS9M/oy+q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786487529, "uuid": "0f5817da-4f9f-4732-9395-9f7b3b24f95a", "value": 6143872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786487529, "uuid": "c56956f3-43d1-4251-9107-a98cc8ddbb81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786487529, "uuid": "c9ee446f-ce73-42df-9bc8-9c2a6e075838", "value": "779d5a88e217ff32e029d08543f76dd0513a660283db1caa567821c45d64d3ce.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e26a25fc-95bc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786477391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477391, "uuid": "80b6d632-d048-4f89-a000-8129d0104d9a", "comment": "Malware payload", "value": "a2689517f01db8dd7b32d7ec050c2d86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477391, "uuid": "cfd90c6d-0559-4f85-a4e9-2aa67337afee", "comment": "Malware payload", "value": "77a2804d73ef1736bd20eda1b7617d4e8b3ed0b59e3715a259bc97d5e60e3a91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477391, "uuid": "a1eddea6-acab-485a-be37-4fa9a046ea7d", "comment": "Malware payload", "value": "649660c27b55b05defa59ff721876c259585ce58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477391, "uuid": "1411dde1-2b95-4e44-81a8-1e020a44b56e", "comment": "Malware payload", "value": "29e387e1b3b8513bab659293321a40fcc40da45f52d414d1e85218d07f2c59e4184e9a5c1fa584cacbc7dee65c0b40e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786477391, "uuid": "153803d3-4e3a-4db2-974f-c0fc945f5fc8", "value": "T12D366B03EEA548F9D296D73588774242B764BC499B3533D32E60BA742F363D0AE79B40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786477391, "uuid": "66ec25b7-c684-4e42-a3dd-9424b328f442", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786477391, "uuid": "dfd9f75b-967b-428d-a467-464a76339ac0", "value": "49152:uFKpz7i7FAlc03DCBGcm+a1h6TczyJPj4RRHrYvAaai:uc3XND1aJrCOki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786477391, "uuid": "d32f9284-d542-412b-b890-7a232851c724", "value": 5003917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786477391, "uuid": "dae18484-75d8-41d0-b309-79cbb47d5c58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786477391, "uuid": "5299c8fd-63d0-4e88-ae98-4bdc316fee5e", "value": "77a2804d73ef1736bd20eda1b7617d4e8b3ed0b59e3715a259bc97d5e60e3a91.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bb63998-958e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786457327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457327, "uuid": "90bbea02-b3cb-4882-b9bd-0d7ba025e3da", "comment": "Malware payload (Mirai)", "value": "6eba0b5da1caed10fccb8572c9740046", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457327, "uuid": "f374659d-8f00-4fa5-9e5a-fc15ddfe1bba", "comment": "Malware payload (Mirai)", "value": "77c7cf1612546a99c871f23320ccd7eab689c81f81f1299fa43324dc907c7349", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457327, "uuid": "a9867685-e3cb-4193-97e8-6f57886a3f42", "comment": "Malware payload (Mirai)", "value": "17d7e52a6ccf6be50588024cedfaae0494007c40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457327, "uuid": "81b7f25e-9393-4f70-87de-a4be00be32e3", "comment": "Malware payload (Mirai)", "value": "2b0e5f0f165318136458e488696b85ba99ce71af3664644b62998c16cc206cdb0229cca11fcc1361f95056fc58cd613f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457327, "uuid": "3635648b-26d5-46f0-9fc5-57cbe3d9d41e", "value": "T14B358D98FE4E3D52D2C7F2BCDE4987A1202B79F4D32781B26A41125ED5E5AF8C6F2110", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457327, "uuid": "0ae1541a-c2c0-40b4-9226-a3ad2ff5058a", "value": "24576:iPKki6ho4AI8yXVNleYUCI4TKUA+RKuj:iPnV0YUSv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786457327, "uuid": "94016d9b-0f8e-4122-9ee6-014112f7c1fa", "value": 1094184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786457327, "uuid": "c5febe33-1514-46a9-9b87-22648987a3fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457327, "uuid": "80028687-daf4-4027-a9dd-d012302c8357", "value": "sys64.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b845aee6-9562-11f1-bd95-42010a9c0009", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1786438665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438665, "uuid": "15e1431d-b0eb-4022-9253-cf586a7dc2b2", "comment": "Malware payload (VIPKeylogger)", "value": "f9382e6cb5a1f8e82964d1c981ea5d62", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438665, "uuid": "2229f1a0-f508-4be6-b632-6fab39d52254", "comment": "Malware payload (VIPKeylogger)", "value": "77de20c27c420e6d187c1a62f1a8be1fd62fbde5645927ceb6e63a6793239031", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438665, "uuid": "b7f1631e-65f8-4fb4-b3af-d7077c9f7e2f", "comment": "Malware payload (VIPKeylogger)", "value": "55469d4e71738d8932a9e6ec47e69df18daac72f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438665, "uuid": "f3ed75de-c202-4302-b20d-ff5a1a3dd8d7", "comment": "Malware payload (VIPKeylogger)", "value": "46800f3da832acb13dd7db62fa9ea19882dbf7e6eec8e61d227348a4e6ecd3792de58d1fff65263b39f77df6f3d3dc6b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438665, "uuid": "369e3bb5-d4b8-4bd7-8f3b-91af517515bc", "value": "T1F6057E95B3F7F2E835E561772C438B538686835D8C71AEA80932E578DE78C10F5A3392", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438665, "uuid": "022361a6-4557-407c-ad48-8eba87da9e6a", "value": "12288:eBvdKcE5mai2PBKLsLA3Wcu+v2HtghdaVGgO3CbPys0YCNR3rF86eLFt1BS1:eBvgYDIBKLR4QdakgOaChR7veW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786438665, "uuid": "83f7eccc-85bc-430b-a998-ce5b24613c87", "value": 863839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786438665, "uuid": "325799bc-7681-4a82-8ea6-246456efb754", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438665, "uuid": "faafb220-3760-4b49-b5e9-7f35f27c86d0", "value": "ScannedAttachedProduct_.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "906896c1-9596-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786460932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786460932, "uuid": "723dd9fd-c787-42fb-86d8-45e20f39cc4d", "comment": "Malware payload (Mirai)", "value": "fa1e986c9650fbca86885b298516b15f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786460932, "uuid": "443a9b70-0187-437f-a85a-9dd12d71088c", "comment": "Malware payload (Mirai)", "value": "78067ed1467e85a1c4ad4a1ef2ffb9e2ae8f0b59ef82ae1da5749ecfe38e3cca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786460932, "uuid": "51cb2f33-0f41-4b41-9b1a-8e9b647657b0", "comment": "Malware payload (Mirai)", "value": "8a5daefebd018d1675d496462385a7cf37352169", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786460932, "uuid": "72cbe120-70d1-41f0-9f8e-8913ecedda0f", "comment": "Malware payload (Mirai)", "value": "e4087b6e2b03c8a7a0d8dc9a31aa1a1fd18ab391e36a0fd59561c0259bb84eceda357e9591f705c0e1869ee2dedf5b42", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786460932, "uuid": "707c9ce0-db44-4db3-87a3-7dd9188d4adb", "value": "T1B934F90AAB611FFBD8AFDD3702E91B0125CC551722A57B763674C918F54E60F0AE3CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786460932, "uuid": "bb58a89d-4b0d-4363-88cd-c04eb94f8556", "value": "6144:u4IHCZA5vbsthc+vQ/PnBvJ/5nVoKHwDLGWd7:7IiPcAAWHGw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786460932, "uuid": "7acef486-2d56-4143-af2e-2360e0de1307", "value": 235328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786460932, "uuid": "e978171b-6c54-4a6a-8920-68f2a4c7e1ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786460932, "uuid": "e22280b1-9f6c-4653-ac5f-72ab9a8cfe59", "value": "sdfjgnjsdf.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02c27313-956a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786441797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441797, "uuid": "9baa189b-926a-4666-a5b3-af0dd9f885c5", "comment": "Malware payload (Mirai)", "value": "a71e52146d07228047c8eb1e56d28b25", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441797, "uuid": "b4ca8275-d965-48a4-a8a9-a4ef590b3ae2", "comment": "Malware payload (Mirai)", "value": "7859e4d26e81ddd6562e7ce8fec5a5777e4572f3e38da1f0438823b858033d5f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441797, "uuid": "75095699-2dc9-4e61-ac56-f33a3a7214d8", "comment": "Malware payload (Mirai)", "value": "9a475c21f2ea3079dc356b5c775b5fb991743a4c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441797, "uuid": "d3d6ecce-a590-44d1-a9d5-15936490e7f8", "comment": "Malware payload (Mirai)", "value": "c32cdaaf2cbbcf14e8a2303386d928b4748c288463c8bbad2bb70026422f0925a6d694ca961695fad505548fea1fa80c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441797, "uuid": "d2fe51c0-6ac0-4ae3-9b89-5f719fcfd985", "value": "T18F23F19DAD3839E6CD9DCC39908A1BB2C755A0C0723AA68CC3104DDE958261FA07B97D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441797, "uuid": "899997c4-3a41-4bbf-9d6a-5e7f98c38016", "value": "768:hSpAPHcr1znPLPlL5x4kyy1O7otJmap9nJ7TnBqb/WVGi+DWWE:hpvchTPLPR5Skbcamap9nJnnqDA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786441797, "uuid": "aaab834b-52b0-4cf5-886e-6da41823684c", "value": 48128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786441797, "uuid": "6bba178a-52a4-410b-8f85-80075d61d69b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441797, "uuid": "bd335196-0be2-4bd0-9c5d-712ea8c96036", "value": "Mystic.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e5c81d4-9573-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786445816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445816, "uuid": "bcf66fb3-d700-4ae3-8aed-012247816a8d", "comment": "Malware payload (Mirai)", "value": "7a34c0a85b7aa27af08149b7417d5f86", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445816, "uuid": "ed86e1e1-1763-4aa1-9d56-fe26d7dcd035", "comment": "Malware payload (Mirai)", "value": "785b79205d0c9ce28ba9f71a8fcd93e1fd0eb9a91202fda96481c495524dd844", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445816, "uuid": "5defb1cb-921d-4228-9c03-5993ac6be0fb", "comment": "Malware payload (Mirai)", "value": "62f61749205cd4343392b89422177dec40325ccb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445816, "uuid": "b83c4869-6d54-415f-8611-6f737430eaaf", "comment": "Malware payload (Mirai)", "value": "769f279bed4e15af7f926e61f42c3360c8dea4c6ef9a07d0cf26d46b7f8f18394d738ad0d2a30bc1be7f99293a21920a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445816, "uuid": "a1411b5d-a7d4-4cc0-b3e0-dcc8460dbd95", "value": "T145730249E545B185D7AFCC38203E2648490876C233B992FD2279B8E8115C997BDCF1F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445816, "uuid": "bd40a638-3069-421d-86f4-08d0f14592d2", "value": "1536:ymBUbTGCjatGYFaYUNyae2ehwDzkfESZD62dvuL0gTX:IT3WG7YIi2e2DzZSzdgTX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786445816, "uuid": "caec917d-ecd7-496b-aa20-0665cce3f993", "value": 73772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786445816, "uuid": "dbd7127a-9704-4948-9719-4c648e19f77c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445816, "uuid": "d22f6503-1eed-4133-9857-e625d6ce36a3", "value": "sdfjgnjsdf.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0767f9e9-956a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786441804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441804, "uuid": "f0a8da6a-01d5-4dde-9ec5-422f64c192ba", "comment": "Malware payload (Mirai)", "value": "0578ae90caba6213de8ef07dd9a4fb6f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441804, "uuid": "b426b1c0-e05e-4fb2-9525-cf2af24dc28d", "comment": "Malware payload (Mirai)", "value": "786d2ef2b1194a4dfa280e044e4bbcd9ab95092c46ef0771cefdf1890ebb73ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441804, "uuid": "07cd09fb-20c8-46a1-b4bb-6b7f53932197", "comment": "Malware payload (Mirai)", "value": "a34bd9076a267846dad877a2a3b7db231233ea19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441804, "uuid": "4b745abd-58e2-4d06-a5ae-abc05b29a4b5", "comment": "Malware payload (Mirai)", "value": "fbe7580673ed76cb41d934a0bc28fd5f238ba7560d856a2978d2fc50bedb37225cdbc66dd63d0c7e262df778eef6cb00", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441804, "uuid": "e7c26fbf-bbd6-46a3-bb92-e97201cb6c8f", "value": "T1AD13F1F291B44B8DE66D833C5D6DBE268D14D11D184C50A9B74860AB1EAEF0B3D2CBD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441804, "uuid": "ad54ba44-11c8-4b03-b4d4-fd6a3acf22f3", "value": "768:W3nImPwX+GiDxdYP8/XG8KcfhExL7Sw7fhPO1lQGb1qQ/1UKx1moPbOnbcuyD7Up:8qXkxdY+WqJEx7ffh27thqQ/9HPbOno+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786441804, "uuid": "a097ffd8-1db0-4ed3-8f63-18094d558d9d", "value": 44960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786441804, "uuid": "2b809603-9f04-44e0-a565-00df5cb52a94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441804, "uuid": "eb7272c7-c690-48b8-9984-c96070e3a6be", "value": "Mystic.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7be4b282-958a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786455744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786455744, "uuid": "3123d96f-04f3-429b-b732-7be36d03a424", "comment": "Malware payload (Vidar)", "value": "4f4a515364e4e93a9b112fd5dfc89470", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786455744, "uuid": "10553c40-ec72-49c3-ba59-bcd5b951fae2", "comment": "Malware payload (Vidar)", "value": "78f86806e434520caf431fae5d1a11405f02ab4d53779dfa422584067aed8961", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786455744, "uuid": "2a42bf68-ddd4-4dbc-a6a3-5f5d18d2d4a4", "comment": "Malware payload (Vidar)", "value": "5be3e23a9a1908f29c9367eb9814951925227309", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786455744, "uuid": "2c0be4d8-6b16-40ba-accb-6d86fee7a8a5", "comment": "Malware payload (Vidar)", "value": "7ef36e060a4bfab254ffb61856f44cd628331cc2546e0b40e48c9fc7dbe82822826765152ca7be703af9b70e959df3b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786455744, "uuid": "c7cb5ca6-33fb-4396-921a-2313ab946107", "value": "T144268D03AD9118EAC096E73189B75652B674BC0C4B3233E73E61BAB82F32BD05D79754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786455744, "uuid": "c6f89e10-380b-4a51-8ba5-a512f9fd6d15", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786455744, "uuid": "d83c78aa-7064-42d4-9c32-233759e85e5a", "value": "98304:KYQLbSLKavRxlswLy/NKbXIdOI2Qfv2hQxtkkIyaBg4pr0rxx:KILKavRxlswLy/NKbXIdOI2Qfv2hQxtj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786455744, "uuid": "f4a8257d-4a34-46d2-9f06-15f8d217adc4", "value": 4731760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786455744, "uuid": "4bf5c8fc-9037-4f80-a233-989213c7bd98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786455744, "uuid": "22735226-5b4f-4ec4-8e43-0ad98a21a539", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3f7f138-9599-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786462361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786462361, "uuid": "f7fe2e7f-4607-4834-832e-1569f2bff722", "comment": "Malware payload (Mirai)", "value": "d9c43fa247410af99ef12fea1d82ef10", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786462361, "uuid": "5cdb2720-9d5b-43ae-b869-f5266551a011", "comment": "Malware payload (Mirai)", "value": "790287667ab5d0903da7bd8c66db0a62b52a9658ac55fc84a9a7210340e11829", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786462361, "uuid": "c57a95b7-6618-483a-a6df-4472bdcaa478", "comment": "Malware payload (Mirai)", "value": "a75f032062c10057915880fb80796b3fda05543f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786462361, "uuid": "715fcb7a-d515-4d34-9c54-43b15d5025b2", "comment": "Malware payload (Mirai)", "value": "53330b4475ab89f7ba6a23c8fbe77fad70939b818188d52fa2df574a119f581ed92b80895e9cb4a9fdd63774cd676880", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786462361, "uuid": "d1073659-ad8f-440e-a564-73501008f671", "value": "T13433F1B480D089F589A2143D576E848506BF9B6092FF37A2078DC72BDE4015B37B9733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786462361, "uuid": "f52a9809-c153-4d6a-8531-ada62809e95b", "value": "1536:aNUMvHkg5OvgAfjC894F0usD1lVI1yMCfzW:aN7eHCy4nglVI1oq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786462361, "uuid": "c984e5ce-4d91-4436-a4a7-0714d19be7b1", "value": 54056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786462361, "uuid": "bb19ed62-2e15-469b-a82a-d497605882c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786462361, "uuid": "11d1ccb1-36a0-4db3-9ebc-bcbe85005539", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39a63e59-9560-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786437594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786437594, "uuid": "72a3db77-54e2-4d4c-9234-343f84a3d50e", "comment": "Malware payload (RemcosRAT)", "value": "ca563a9316eef658f6b736da3e6b299a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786437594, "uuid": "4fa690ab-1712-42ed-ab3c-80e3a6a4d0fb", "comment": "Malware payload (RemcosRAT)", "value": "7982ab072cd83fbd35f66c013c79bc4a64cf8f78dc3e50846a510f7558059f5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786437594, "uuid": "858feaf0-dace-48db-9cc7-b70f69c89cd0", "comment": "Malware payload (RemcosRAT)", "value": "1058b439e39a60ac59c0d9021d9254696b7c6a3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786437594, "uuid": "b0ea9f5d-a394-4e0b-b62b-0610ee8281a7", "comment": "Malware payload (RemcosRAT)", "value": "5617cb5a9ae7dc05bb24a274f6deb13eff1aadb256b4ad2c9e7b08449c17d6817446f361b721304bf2b30912e04adeb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786437594, "uuid": "35412c14-3382-46d4-87b9-cc7083f6222c", "value": "T12FB4D052FB93C07AF6611A364D27E3729DB91D2015158E57E3DA1F22BD30291CE3FAA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786437594, "uuid": "fd0ec1ec-b36b-456b-a5d8-dfb10354c69b", "value": "12288:4JgG3ItyHp/uqAcIbez7ZntwbfNq4ZkGI:GgGYtgWqNIOwbf84Zf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786437594, "uuid": "106177a4-35ee-43a5-ade5-deee81e802c5", "value": 494655, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786437594, "uuid": "e4769e58-76bc-48f5-9795-3ffb101668e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786437594, "uuid": "c50ee22f-8c83-4d10-b5bf-944ca8ffdfcd", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07575a91-95bb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786476593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476593, "uuid": "c71c32f8-9086-4959-9836-84ad672769c4", "comment": "Malware payload (Vidar)", "value": "9a26ba6d4c0baa29512b0f32236b6f0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476593, "uuid": "5f7595d4-30a1-43c8-91ff-568c16d47aa5", "comment": "Malware payload (Vidar)", "value": "799c075cbf035d8c61af0d0c5297f73e6ab0a8e9cd39253e27e827255c03b6fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476593, "uuid": "249a586b-22d8-4570-8ba4-e115b9a5fb89", "comment": "Malware payload (Vidar)", "value": "00f193a8ddb9f184838c5955692bf272df70189f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476593, "uuid": "2d818c8a-48f6-47f3-8894-cffeaa68ce64", "comment": "Malware payload (Vidar)", "value": "de52ab5cf928aaaf548e2e6c2d4147b393a2734775b653c23d6f4fbcc3e4f3b6a4e6e88f5cde44c906b9226baa81c07b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476593, "uuid": "bd1dc94a-dbfc-47d0-aee7-56e6564f3aca", "value": "T1D6466B02BEA24E78C0D6E731897B4241A674B84C873537E32E65AEB53F763E15E75B00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476593, "uuid": "051e1e80-a16b-4e39-9b9a-72b88ddcc8e9", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476593, "uuid": "1b5db7ea-4b2d-400e-b86d-575097d2c5a6", "value": "49152:gVVP30aEPJFl3mJxjNalbEw09DUTGs38iAZ2rC2cFRgT6Qobl35six8LdwXB1NI8:gbvgnWvwQbl3CyJmxC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786476593, "uuid": "bd123fec-2c4c-486c-9203-8b8afff26502", "value": 5358592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786476593, "uuid": "999cafe4-5055-4af9-8ae5-c17cba2ac355", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476593, "uuid": "6c3f8e66-1cc0-49b8-b0dc-3a7a59bfbd88", "value": "799c075cbf035d8c61af0d0c5297f73e6ab0a8e9cd39253e27e827255c03b6fe.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3394bd0b-958e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786457340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457340, "uuid": "3ef3b407-62b9-4351-9ba5-ce8ae28a14fd", "comment": "Malware payload (Mirai)", "value": "5b1f4dede73e804bb376c0cd826d8e2f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457340, "uuid": "6e144ef9-6927-44bc-be87-aa8e683bfc87", "comment": "Malware payload (Mirai)", "value": "79bb77fa4e79247e7e774dcb7b9b64d400ed8554f3edbc1200ca420c51a60af6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457340, "uuid": "7d57350e-9962-46dc-a06b-322081e172a4", "comment": "Malware payload (Mirai)", "value": "2c1a28aeda32cec4eb3538204115ef331d90ab87", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457340, "uuid": "3eea8a57-171a-4c70-8718-2f8213c1b69e", "comment": "Malware payload (Mirai)", "value": "1e6a2ef93b53dab208147231a7b904f18c1550429431e66702ca092cd24adeb4b56075a67f15f9044ae986fa5e1c1f10", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457340, "uuid": "5221bd3c-e6fd-4ef0-b25d-d414bb4f4b52", "value": "T105947C83B440CD7EFC47E77E45074F06A030E62551935F2AA24BBD66AE3B2F41A72E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457340, "uuid": "da128117-92a2-4725-9d44-758b19b859cb", "value": "6144:UOZoG7UM9R52/r0bk8vhOz8mAhZ28Sf98W0ApPpL3ZxINFp4wOysX0RCnNFVwvtD:bUAFhOx8KFxu38wvtxVj+a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786457340, "uuid": "b84cc707-370e-4d9b-b29f-91ffc6a30b1c", "value": 421092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786457340, "uuid": "ef4e6d22-e6c7-4601-b29a-f5847ae7300b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457340, "uuid": "6b92731e-9a5c-491c-8736-9009e386e7d3", "value": "sys64.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d5f108f-9560-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786437600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786437600, "uuid": "ea279e1a-769b-4c54-8f49-42393553722f", "comment": "Malware payload (RemcosRAT)", "value": "b97308e089a43ed4e344dcafead999df", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786437600, "uuid": "5474ac84-7bfb-4566-9d31-8304dfcd95fe", "comment": "Malware payload (RemcosRAT)", "value": "79cdcf7cc2f240d1c2248eae70073c0981d8d74fd8f15529dde838d72a5795f6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786437600, "uuid": "13b9704b-8331-40bf-91e2-e31cdc88fcb2", "comment": "Malware payload (RemcosRAT)", "value": "fb96bf0121c5475ad4fe96fc91eb6637be4ce01e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786437600, "uuid": "46189473-95f6-4d7c-8761-5291ef6a5e4b", "comment": "Malware payload (RemcosRAT)", "value": "5f1c3a13a43cb98917119987842ef16a09445d76684eb6f688518125a55dcb1fbc2a2c8a0277189bcff82bc3cbb99e49", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786437600, "uuid": "a006dc4a-43da-419c-a1d7-fe8740f5a854", "value": "T159558EDE387DE776D6905E2208983022A4A368ACDDCD00F5E513FAE8B50CD0ADEF5756", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786437600, "uuid": "192a318e-4405-43d9-aabe-b40f518fcfdd", "value": "24576:TRMcG5K7QSvXEs2XZ81OMLUecAlDuO0qYdINHhilOmgTpw:TRw5K7QSsXXZ8ARWKORwINH+gy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786437600, "uuid": "35d3c275-59ef-479a-add3-e47b4fc2e369", "value": 1322127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786437600, "uuid": "d2d06aa0-bc0f-4563-b093-2719173a3288", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786437600, "uuid": "d95be555-7145-4768-8769-fd2c91822ea9", "value": "wennedsometingbetterfeaturesfrom.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b646f6a7-95c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786482041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786482041, "uuid": "e8797b89-217c-412b-ab72-c8aeb91b778a", "comment": "Malware payload (Vidar)", "value": "315ebe0e62dca55acf72e3ce0f53f1fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786482041, "uuid": "2e792c53-256b-41e9-95d8-2d085b540722", "comment": "Malware payload (Vidar)", "value": "7a67319224361e3f7f39687c2b04dacd710b7b10293ebc98432085b9f34d7f61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786482041, "uuid": "9fced89a-63ea-4aa9-988e-0ecdf0dbd6b9", "comment": "Malware payload (Vidar)", "value": "6137c3983682331288f0abd45b616e59ded316ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786482041, "uuid": "a8e3383f-398b-4a9f-8451-5e04cd621b12", "comment": "Malware payload (Vidar)", "value": "2f358aec6d827069c4f00385093b929ae4b4a7b146eb40d889be9f7c1e22035d4f8b1442e5e925ac37dfb3315c02fed8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786482041, "uuid": "3458090e-91c2-4a98-ba02-8f972336399d", "value": "T1EA168C03FEA14DB6C0A9A2328CF252527B38B84A5B3367D72D51B63A3E767D05C35B14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786482041, "uuid": "fac6f92f-4c32-419b-8b32-4882b3b3929e", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786482041, "uuid": "90cf9ee5-4200-47a1-8a92-d2e6f9cccac9", "value": "49152:D9qCkJW+mNnoy62RnS1loAN6ab9nIyuOQyER+0v0t6Fc0kMShP5zVeQJ8VDlyxvl:DiP2/vLV/s7wseK37Cjt7mr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786482041, "uuid": "335de5a8-6034-4715-ac51-04e10483a1c4", "value": 4291856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786482041, "uuid": "bb04c806-72ea-46cb-8a88-89d1a2e988c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786482041, "uuid": "ebe8405a-094b-468f-9a77-4e6e9ac69718", "value": "7a67319224361e3f7f39687c2b04dacd710b7b10293ebc98432085b9f34d7f61.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19de5d03-958e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786457297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457297, "uuid": "1d38aea4-b46d-4f44-b562-3396d6b9482a", "comment": "Malware payload", "value": "cf5f4524a60da91e39e5d965d4c57931", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457297, "uuid": "d6156531-0ced-424f-b052-762f0b674c7e", "comment": "Malware payload", "value": "7a72faae6674d55cf2a387467b9e68ba41e43ef7def5900dc7f2f45fcca1b8f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457297, "uuid": "ba706142-500e-488f-be3f-0ee900a61a6f", "comment": "Malware payload", "value": "1825642c19710d77c6e5e766be43f7f9ea391bb8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457297, "uuid": "bb2804cc-55d8-4b50-b071-fbc4a48443d9", "comment": "Malware payload", "value": "ef7710a189e75bdcac557d91c1258bbf86b784f4b86ca9bc9a0f47881f5abee6691c724db9fe92e3e562f78a7c1e7c45", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457297, "uuid": "fba4c8aa-2b1c-4ad7-a0ca-4c8cc8193a6a", "value": "T1EFD4D80B6E328F7DF67587314BF70A249BAD23D623E1C581D1ADD1141F2128E592FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457297, "uuid": "453b1ce5-aaa7-4746-9bb7-07233934b275", "value": "6144:4ECVrtGHdhQMYvHpNnyEEGM/OlJgmtUYOD4oHKBY8SgslnAIAC8ZPhyTz/ba5Xsy:fCcPmfpNLM/tzw5X+jC+ZIqn5jy/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786457297, "uuid": "8acf73e5-5dd8-499d-a7e9-a80378692a24", "value": 648320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786457297, "uuid": "f3b99510-904d-4bce-ba9b-d2fdd897f1ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457297, "uuid": "2ab64299-52cb-4015-9b1b-6a4e2ea6995e", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "253e6a7b-958e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786457316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457316, "uuid": "89b83aaf-86fa-4cb9-84ef-50875bf1ad65", "comment": "Malware payload", "value": "950833fdcf244a7ab59a6e2f6d486c85", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457316, "uuid": "d77bba47-a882-4cf5-8464-b9e98e7d6168", "comment": "Malware payload", "value": "7abc715abd2e76a81173dcaaa90028f8081c552cb074352b8f404780bddb850f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457316, "uuid": "de767645-0b33-45af-bd8c-50fe697a7e85", "comment": "Malware payload", "value": "835912cc9fdcacdc3ea80b645fe6f10d7033d11e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457316, "uuid": "d7c10ebd-acc1-452e-871f-966662f52f45", "comment": "Malware payload", "value": "28b8b876bb62c3a8b8df58d50128fecf4f953e22f778d5134ad124da368fd0a9fcb45bf2114b70ad8db8eedd43943867", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457316, "uuid": "4e34a478-0ae8-44b1-91d5-344e9ab908c4", "value": "T1F8D0C765B47774D54E5CED45B2E14A6E7001935D10276BC45CD6143D987848CB470D14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457316, "uuid": "68d7c296-5035-48a3-a10a-ffc8c9f822a1", "value": "6:1IJUY2ASeFa0LKiO3oqZVIWGa2xISoqbv:1Iu7ASf0LK/3uiSJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786457316, "uuid": "821249ce-90c7-4406-85c2-a73b59c58394", "value": 203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786457316, "uuid": "e82ee8d9-37c6-428d-ac41-e7d5e2ba8096", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457316, "uuid": "75a64475-d657-4109-a905-a2652d2f6b43", "value": "wow", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3134853-9549-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1786427892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786427892, "uuid": "aef0b568-f7a1-4e23-a3b4-7dce5555e523", "comment": "Malware payload (ConnectWise)", "value": "3af4b1b06c931dda444e82ee6f756361", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786427892, "uuid": "92d0b757-af75-49da-b06e-ba611c785560", "comment": "Malware payload (ConnectWise)", "value": "7ace2517f867d28a2e341cd9a9caad287630d3e93b2ae6ecd3fc027dd55ff8db", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786427892, "uuid": "e2150b96-f31b-4bda-b3a8-b046babca11c", "comment": "Malware payload (ConnectWise)", "value": "fa13d344e87567fc5becc72a70be93d5ac0df160", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786427892, "uuid": "76a799d7-b98c-413c-9d3a-d259691aada5", "comment": "Malware payload (ConnectWise)", "value": "23e7570fe52ae1a5f1fc6a5af0a086f30439fbf13def485d13d40fcf7817e230f728ca1d28972cf5f23cce967570fec5", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786427892, "uuid": "03b412ee-9b1d-46fc-8edf-a82996380cb5", "value": "T109647D11B9C48432C673383147B8E2B28DBDB8301D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786427892, "uuid": "b5cbf466-34b0-4cf9-a2e0-259e44e52cf3", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786427892, "uuid": "f146e03e-838a-46df-8afa-155bb5b1821b", "value": "6144:imlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9X:h1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786427892, "uuid": "289c66c2-05c6-4130-8ec8-d75b503928e0", "value": 312560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786427892, "uuid": "c14acce2-aa40-4b66-9299-b77107f8e2d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786427892, "uuid": "1b9c1b0b-0a41-4181-8953-4d3dcb420708", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beb4a278-9562-11f1-bd95-42010a9c0009", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1786438676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438676, "uuid": "b1e8dc4b-5763-4144-b8db-9ec1e9222529", "comment": "Malware payload (VIPKeylogger)", "value": "ae7b8162899c144e0bf794afe29e7707", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438676, "uuid": "2fe79589-531d-4d38-9018-8ff39339c490", "comment": "Malware payload (VIPKeylogger)", "value": "7ad455c6c09e8b6939957dbd6747dbe0748d78d3a78c4bb4ebad00da652f50db", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438676, "uuid": "a6cccf88-35ad-4a0c-adba-d3ed6a2edeae", "comment": "Malware payload (VIPKeylogger)", "value": "a6ac7cddf9c9c9d43d8f61dc80cce197de04f077", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438676, "uuid": "fdb56dde-baa3-4bfa-a2b6-13afe8120454", "comment": "Malware payload (VIPKeylogger)", "value": "5dd071e34f6b85c4d308ef940cd3bea1890c5cac8ff09d1af3876e340482a1c31ce7842a188bbd0e1563bb967cf640fa", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438676, "uuid": "3d38b695-a019-47bd-acaa-5600d18bdf8a", "value": "T1DE53CC84559329885737BBAFB32A98E4F3B617AB01914D17783C6450AFF1C09DDE0CBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438676, "uuid": "853d337f-0ea2-4f19-b8c5-9dc5247b0acb", "value": "768:u6w5BZLp8F+lWUH3djkLqnZmSsKfKeiypu5qFux0Xrvomrp/WNs0q3mQfwxSvbxo:85ODJ1ePj0J8cm40E8OsXRO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786438676, "uuid": "cdc7f7c0-669c-4b9c-b700-fa1c209fa9b4", "value": 62288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786438676, "uuid": "1c9507ac-3f2d-43e7-aea3-988e883f3dc2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438676, "uuid": "3464f63a-495a-496b-a552-3060c442cf12", "value": "MTO PSV.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d275cb08-956a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786442145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442145, "uuid": "3684fa42-d8b6-427a-9ab5-0a11a30ac3f0", "comment": "Malware payload (Mirai)", "value": "e21c7275378bfe9438938ae4e4d0794e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442145, "uuid": "797703eb-f298-4ceb-a3b2-7107effaccc6", "comment": "Malware payload (Mirai)", "value": "7b4f28cf2bcdb799c13dcbb44d6f1edbab76cc4fe01932e941f04d35f3e59099", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442145, "uuid": "4315357a-7294-492a-a2db-a6d7ae04940e", "comment": "Malware payload (Mirai)", "value": "18b836e72ce2b4d014bcd671873825b2d0f81e47", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442145, "uuid": "2407b91e-a681-4a2b-957a-ce133298098a", "comment": "Malware payload (Mirai)", "value": "07dc3b6b0159b61366d45dc6e10627383aa2e6552cf51904efcfb51f9c78cf72306450a7027cbb62a986edfb3fe4ea55", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786442145, "uuid": "d33e3bc8-33aa-4d81-bf04-f02268d029ed", "value": "T10C145A02732C4D03D1A32EB0373F27E193EF9A9225E4B545295EAF9E8075D325945ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786442145, "uuid": "26524e82-c7c6-49c1-bdd2-dcb4c8cd3ffe", "value": "6144:p56a7qav2Y5UeMxMxxE7abLdNVPtXoQsLnu:p567av2Y5UeMsfBPZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786442145, "uuid": "212cf904-c502-4908-ae20-3a2fa71fbb7e", "value": 200816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786442145, "uuid": "1c93a893-feeb-4bfd-955e-3eef9c32ced8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786442145, "uuid": "7ad24bd3-1b15-4eb5-9544-5f49f5c270cd", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea22973d-959e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786464519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786464519, "uuid": "41edc33c-ef2b-4362-a08a-1ec79896abf1", "comment": "Malware payload (Mirai)", "value": "bb4372e1ded58d6c64ffa97e7a3a876b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786464519, "uuid": "6052af3d-5deb-4c63-9e5c-974e2d75a2f6", "comment": "Malware payload (Mirai)", "value": "7bb72c87e151070f9af16dcb07db823602f0bb7ecd03f41871386c3256622c25", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786464519, "uuid": "fba59f16-a568-43ff-920b-fdcdc728fdc3", "comment": "Malware payload (Mirai)", "value": "3acbdf34367bf208a823ae7e9698ec97662f21e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786464519, "uuid": "605b6e67-c9a3-43ea-a373-d3b2584fae87", "comment": "Malware payload (Mirai)", "value": "4fa882a277227be333e37cadd943ed493f3a56aa4217337cbd04496650708ec71ea5c0ab2eff5ffe66027487a70c691c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786464519, "uuid": "4890e2c4-2ae9-4f96-a498-ec7001176318", "value": "T12A4302AF851C04D5CC6EE8B80AE927FAA4B94B116402CEC2C287D775CF452F97452AF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786464519, "uuid": "b542e9bd-ff74-4aa2-9ede-deb4b2c3e14f", "value": "1536:FkHTtPG2vmQj15lWOWG4rnaeCCWHIVJuI:FYtTeQj70O14TRCCWoVQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786464519, "uuid": "ea8fb99c-55d4-4076-a580-33ab08160d6a", "value": 58908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786464519, "uuid": "72770fb1-d2a1-424f-9041-c590a95d5dd5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786464519, "uuid": "1760f710-decb-4244-8109-4527626787ee", "value": "7bb72c87e151070f9af16dcb07db823602f0bb7ecd03f41871386c3256622c25.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24d14437-9569-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786441424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441424, "uuid": "8c3074fa-55cd-40aa-a0a5-2d660fdaa603", "comment": "Malware payload (Mirai)", "value": "c5fead488deb017b1d8aecdc59125ae6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441424, "uuid": "50b558d8-009d-42b9-8c3c-de102dba401b", "comment": "Malware payload (Mirai)", "value": "7bc7e75a789700f1617e77b4be3323f03339122d6d87dd011a7b7157e3c4e495", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441424, "uuid": "7b27c8c6-7c3c-43db-b4d6-05ecd193d51b", "comment": "Malware payload (Mirai)", "value": "c72f2a27f0c009f571ae9aff5d625a8305e4a602", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441424, "uuid": "298d7680-1639-4c17-96ac-0f922048e3b6", "comment": "Malware payload (Mirai)", "value": "5eacbd7f3fb70ba2903620246ad99c90a0afedb16919b5e48772fbb6f4a6ab6ed54670d46e24de101724f9c08e4a9bdc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441424, "uuid": "d910d1eb-45c9-43f6-87c4-3e2d8c109532", "value": "T1BC245CC7FC00DDBEF80FF3B6445B090DB570779514532A3663AB79ABAC3A0851926E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441424, "uuid": "d59c9c25-2782-4cc3-be11-1b1504656bc5", "value": "3072:Fwjxh4OHCVNWIDReNDxj2zSKyTPtGIoN9T6LShNScV7jbiML7hRzO1cF62yKLO:GrEPZcVj2TyT1GIoNF6kNSsLBYrKLO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786441424, "uuid": "82242fa5-9bf5-4ec1-b6c4-7fc6d49829f0", "value": 218168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786441424, "uuid": "d2e734bd-a3e9-41be-8e25-cf7bbf2875dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441424, "uuid": "ad957294-a472-4f44-a729-172c82eaf4de", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b40db4f9-9550-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1786430927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786430927, "uuid": "5e55ed85-b88d-406c-b6a3-15a48ec4e8d3", "comment": "Malware payload (RemusStealer)", "value": "a3e2374ef5d6be8e75358e60955175e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786430927, "uuid": "a3ee5c12-1b1c-4f60-a487-64a061b5588b", "comment": "Malware payload (RemusStealer)", "value": "7c37e43235ab3e92051fa215c7e22c679d61443775594d2a366ec33f0c67e0e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786430927, "uuid": "df84c175-2e1c-42ce-b76c-8fadbea54792", "comment": "Malware payload (RemusStealer)", "value": "4d8a94e8719d05d9a6e14df02454ea2ad68846d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786430927, "uuid": "9055e9c5-ca49-41d6-b6ae-dfe2831a3cc3", "comment": "Malware payload (RemusStealer)", "value": "ba2964667047de15848d9f3523fe47dad7930d630dd156e2b3d2c2f3dcab8fe28e51b15688f617b2712fe99ce0e19c91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786430927, "uuid": "ae98b287-6ecc-4292-8429-26eb6a82dc7e", "value": "T193B52B3838EB502DD073FF716EE8799ADDAE7A33660A645B304913474B22B80DE5253D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786430927, "uuid": "cfe0b1b1-a0c2-4688-9b3f-5eadb9dc616c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786430927, "uuid": "af88df08-487a-481f-9e68-45c3137f63be", "value": "49152:Mz/2YoWuNVRILXjYdB0Y2/3xGRnP/cKYiw:NgLkdBC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786430927, "uuid": "3e09bf6e-4f19-401d-9e83-c292185536e7", "value": 2398208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786430927, "uuid": "42bb755b-d4f4-4718-bd77-67895dcd4da4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786430927, "uuid": "10fec3eb-0d27-4ae7-96cc-36091643bf8f", "value": "a3e2374ef5d6be8e75358e60955175e6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31eb468d-958e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786457338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457338, "uuid": "f8197012-0fad-464d-8dd5-45c9834bd065", "comment": "Malware payload (Mirai)", "value": "d7fd9f25f4f8c58927fbaf775d0c7ec7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457338, "uuid": "568cc505-805a-404d-8b82-9bf89739b2db", "comment": "Malware payload (Mirai)", "value": "7caa8b33aed02172518789d84dc2caa9a86a38786173ffc6ec50fc4de831fa37", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457338, "uuid": "556c16c6-b9cc-4593-b37f-7276fb2eb9d9", "comment": "Malware payload (Mirai)", "value": "98c330ae75611836eb39ad8171c91981bbc68c6a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457338, "uuid": "b6f8fffc-f0fc-4dc4-a4a2-09bab2e586b4", "comment": "Malware payload (Mirai)", "value": "8934e1ff69c9dfd9a387385ef49d8083f9fb12eaa86a6eb84b810b40dcb1507ee553d984a168831903e46c9b1941e78f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457338, "uuid": "6a7aa892-11da-4f9c-9d05-152533c42dc8", "value": "T161941865F8819B92C6C02BBBFF5E834C331767ACD2EE7103CD156B2537E689A0E26541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457338, "uuid": "1da561a0-d4b6-4fb6-afdd-127e616a80cc", "value": "12288:gt7iXPLQKJY/H/YQYChzcHo3gxwH8sI2IVeRvP:5AfYShzcHo3gxwc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786457338, "uuid": "a0e4e619-8010-4f17-9a45-850fa7992729", "value": 444584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786457338, "uuid": "3cb032e3-3f0b-4e87-9f42-b9ed9e35016f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457338, "uuid": "0b67d113-f37a-4687-bf06-6db66ae2470e", "value": "sys64.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fab4092e-958a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786455956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786455956, "uuid": "36764402-131a-4006-8e8e-7d43efcb51a9", "comment": "Malware payload (Vidar)", "value": "205ae205117d269047bcaa2e4c331bd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786455956, "uuid": "6e735c11-f667-48cd-8743-8328c3d0c561", "comment": "Malware payload (Vidar)", "value": "7d71cc9be7637526bd044e5558bd9472b9c44d80ec0cadfdc5c50b9331da83e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786455956, "uuid": "9976fb49-c3a7-4b3a-a746-b457f8ccf9f1", "comment": "Malware payload (Vidar)", "value": "9a1f3f80bb4f1b83a885af3cf88d1d1e94ee0d2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786455956, "uuid": "4a49c427-d341-490a-8b37-151e1e1bf0ac", "comment": "Malware payload (Vidar)", "value": "e95c6fc468d91bb5b74f3e743e27f8cc1c866a3af766dbd94320cdf4a020490ba9f194320e4ec800d3314638a9af2487", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786455956, "uuid": "38dfbcc3-d8fc-4f00-8031-0f7f74716324", "value": "T1AB267B07AE9148F5C0A9AB31C8775252BAB0BC4C1B3223D32EB0AA752F377D15D79B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786455956, "uuid": "6e2c1170-9c81-434a-9dec-2077e8af927e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786455956, "uuid": "9cb0c3ee-b14d-48bf-986a-fa11ad7b13b1", "value": "49152:+C9rmOMzuionXWSzEXKeifGCDbRfJ8Dyl+SyWIY5u6fJrqusMj1XoRqpCWER0Aat:+44cdN5VVqZkNokpC+5t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786455956, "uuid": "7d25b341-3822-486d-aeec-82019bb187df", "value": 4645248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786455956, "uuid": "04081445-597a-427d-8887-da6d420b3f50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786455956, "uuid": "978fed68-2407-4cc6-9428-714a790a5458", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "822f2d60-95c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786480236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786480236, "uuid": "a15b1211-7e29-41f5-bbfd-51dbd9e94b16", "comment": "Malware payload (Vidar)", "value": "96ce4791a6c2b2eed321dc2851b2cc93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786480236, "uuid": "4bc30af3-3b85-4623-a899-339d395510c9", "comment": "Malware payload (Vidar)", "value": "7d7857910333e10f4803d3aacc39eb76b562a1cb1d7698051fa8c49e52442d65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786480236, "uuid": "985dbdcc-1968-4a0b-bbf4-331e71fd49a8", "comment": "Malware payload (Vidar)", "value": "0b1c0f28ec91199c870bce0efc717d1d74fe9a52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786480236, "uuid": "4029add0-f463-4ca2-8d3a-90e539e9361a", "comment": "Malware payload (Vidar)", "value": "2ddec3c16a0f02513c3a73655d91815b0eacefa8da1a43cbce866aa719ab286a2191846aa1cf72b0a96084984170eb51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786480236, "uuid": "6297b66a-f36c-4b6d-adc6-0f91a4bb4186", "value": "T1EA167C17EF918865C099E232C9A38242B739BC0F177633E72E616A797F367C05938758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786480236, "uuid": "709e5477-a7e5-48d5-8810-aa6ab9693370", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786480236, "uuid": "72136790-033a-43c3-8859-1309f560d26a", "value": "49152:Y0LCo6vCIBEO8nQ+P2UVPi8GivI7J5mIVoZuHqbmidT46H:Yt+QQvImBZIDd6H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786480236, "uuid": "89536562-dcaf-416d-be9f-a2223dad56da", "value": 4380616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786480236, "uuid": "70c82aba-d78d-4d3d-a9f7-06db041629dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786480236, "uuid": "b973e8a1-a968-4773-bd9c-85cbf1fe71ab", "value": "7d7857910333e10f4803d3aacc39eb76b562a1cb1d7698051fa8c49e52442d65.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d9fdd47-9522-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786411079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786411079, "uuid": "6f79855b-f590-4ece-827d-df2dc5839406", "comment": "Malware payload", "value": "47ec6dc80d63fd0e8ca395bcef37d38b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786411079, "uuid": "3be51be1-d626-4ac3-bb87-b91adb271de8", "comment": "Malware payload", "value": "7dc97e65d07416aac2ec2fa717a672928f5d1abd21d8adcfb108e0373bb5ceb4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786411079, "uuid": "397efbda-5bc4-466b-bb8e-ecc53c066490", "comment": "Malware payload", "value": "9806a757fd4161f8d2d566552c2e868d166d37ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786411079, "uuid": "3c6ac974-506f-49d2-97a5-1022077b966a", "comment": "Malware payload", "value": "e43b4210dec56aabc6698669dd2c59fc9fa46102b7e3db6c3288fd854ce588e367358ba35133fc84458776f07a0f9de4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786411079, "uuid": "5316dc43-e2e6-49a6-870b-7d81f2b87127", "value": "T195D30B13EE817EBBC41BDC74456EC29214E75CFAA2E5A37A71F8469CBE7C20215C3584", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786411079, "uuid": "45c27ed0-85d5-4104-9f62-2c7db2679ee2", "value": "1536:a3UzwPTP2b2IbKVQhUZN1n39v+iFjkXREr:a3UzWCSiKVYUZT8iFAW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786411079, "uuid": "58bc05e6-cd9d-4da1-97b1-3feff7ad2cd6", "value": 140032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786411079, "uuid": "1ec8798d-b51e-41eb-bfa0-f8d99e08f8b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786411079, "uuid": "f2f07cca-80c4-4bff-aca1-e0d0bf872623", "value": "main.mips32r6el", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9d94255-95bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786478691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786478691, "uuid": "06697f64-9606-4d1a-9364-8631ca6380e8", "comment": "Malware payload (Vidar)", "value": "ccf3ad8cae35dfa300b47890b374ca00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786478691, "uuid": "f0919356-25c5-494b-94cb-17ee85e52037", "comment": "Malware payload (Vidar)", "value": "7e3a73df4bf29bddbdfe03f64580833039a7d5d2a7e55303639b76f32e22c481", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786478691, "uuid": "5506c24e-2dcb-4351-ba2b-65d72acc5b4b", "comment": "Malware payload (Vidar)", "value": "776f046c31cb6cf94b9b19baa9f6500f94167d73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786478691, "uuid": "738a4823-9383-462b-b502-32349264514f", "comment": "Malware payload (Vidar)", "value": "e644901e09259654cb40857354d414cb6ee04da300b4251289efa8ef24d21194a6044282b27bf65231943580915dece6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786478691, "uuid": "26c29ae3-9835-4bae-83d4-7d8cb635f4a7", "value": "T191566A07E9518675C486E63494771212BA66F88CC7393BD32E71AA303FA77F91E78B04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786478691, "uuid": "6507ecd0-59c7-44a8-9faa-996fc66834cd", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786478691, "uuid": "1d19c947-f4c1-42c0-87dc-27c4f5aa934a", "value": "98304:/Brk4H+0rfHE5dB8tebIOhxS5LS874nv8rXn:/53rfHE5WJQxuS872M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786478691, "uuid": "a5d750ee-5865-46ba-9649-dcd461d599e3", "value": 6282632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786478691, "uuid": "8b00d6e9-81ce-41be-bc75-9d01204ba74c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786478691, "uuid": "085b252b-bcdd-47c2-b934-27afc6551ec5", "value": "7e3a73df4bf29bddbdfe03f64580833039a7d5d2a7e55303639b76f32e22c481.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5a2c815-9590-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786458525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458525, "uuid": "684ffaf1-8dca-4cef-92d6-156c1052f524", "comment": "Malware payload", "value": "4faec8cf9a7fb16edfc413a98c8c02cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458525, "uuid": "ac1167c5-f726-4c5f-b9d8-38e308ba247d", "comment": "Malware payload", "value": "7e4c9212caea0b937bd4c4f84f3471145c3f82d7530f1b316db6796eecbb5513", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458525, "uuid": "505f7ad1-afa2-41e6-93a2-474fd437157d", "comment": "Malware payload", "value": "78dc949a772e1f66d2a4ce7e173efec25d0a1610", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458525, "uuid": "7068547e-5a94-4e2a-aa94-c71dcfbf461a", "comment": "Malware payload", "value": "924a09914ddecd51416f2875f51675c96f26ae894b09e66b6373b750692ca00059c373955c8dd7b71b9a5fa79548b6cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458525, "uuid": "78d17567-b5f4-4997-8931-7cdbdea8ccb8", "value": "T1A5D3A1876A16187EF0B207B105DECAF83E3792F746B70D16586B1EAD5F03E959E060C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458525, "uuid": "1588e3c3-8488-49a3-b752-025ff99edd17", "value": "1536:q3scHfeJAzJHienI26YqKep1XjUn5p5M/LWnp2WmZNIUaipFq6sx+joowblHc:q3sc/eJAxiG6jf1Xjhqnp2Wm9q7AwpH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786458525, "uuid": "27547bbc-4075-4f29-9579-15f6cb5ba4f0", "value": 133376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786458525, "uuid": "106787ca-007b-4158-8001-189c99620fc3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458525, "uuid": "7d3a7561-c61c-42eb-8ac0-65c6bb7e91b1", "value": "main.xtensa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08b4c8dd-9562-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786438371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438371, "uuid": "19ddc615-31b9-4788-9149-d812e031d50d", "comment": "Malware payload (AgentTesla)", "value": "5b6ec5cee90be95b204e032b18a4925b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438371, "uuid": "d3ec833a-7507-4715-8056-735d0788a2cf", "comment": "Malware payload (AgentTesla)", "value": "7e545f358c4621132cbe0e8316e3bbdc14c30e02039e2880af90a01d1cced571", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438371, "uuid": "c525d780-b295-4b1f-a1ef-0d89b4ebe0a0", "comment": "Malware payload (AgentTesla)", "value": "1d573ebc10518f47579c82cb4e64b76b90853018", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438371, "uuid": "83f7e3cd-c53e-44d1-a7c7-f9391a853df9", "comment": "Malware payload (AgentTesla)", "value": "8a4c718f0c9948621690e9ddbd21fcf65a9ebef1cf207cbb78ca34a02bc51d7e8e2cd3d77e9fd63a6e5ecb58ff874605", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438371, "uuid": "cb658654-9ba9-4dd0-ae13-99e8bd7eea2b", "value": "T19B063A10A7A46BDB085CF3AFC929BFDD430E50176A68ED85777F8938B41DE0972502A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438371, "uuid": "410b828c-4a3e-4fbd-bbe0-41c6f3cab0e2", "value": "98304:WGljfv0BFLPVNdftsaSUolNr8fo0PAiVR8NqmpBCPR3scdArdfYuBjrcf9i3HUnf:7l7Eb1SUolNrA4V988aKYQrcMcf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786438371, "uuid": "6281ca7a-a778-43d0-9487-f9d96d9b1d2d", "value": 3712221, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786438371, "uuid": "2ac1d2cb-f6b8-4ef4-a68f-7bdb838e6365", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438371, "uuid": "624b3c5f-6f35-4857-9787-803bd923e915", "value": "PO.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49dd7068-9530-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786417005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786417005, "uuid": "9ff74835-89e3-4fde-beac-c500cc0f171d", "comment": "Malware payload", "value": "ece3a2e35170d1b67693fa7eb4a9d93e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786417005, "uuid": "0771a9c9-993c-4131-85aa-8a68787c460c", "comment": "Malware payload", "value": "7e9d58c5f7497a3de600b9c578e4a55a3c0a7bc741b84acf9ba7a6f91335fc20", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786417005, "uuid": "5dfef2c3-0c6f-4dd4-8d3a-b6a2bbebf103", "comment": "Malware payload", "value": "0eecb5ddf8c86c11c800803d6b0b72c9d59c212f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786417005, "uuid": "7ff3d52a-7b2a-49a0-a2ee-a6edfa1a3adf", "comment": "Malware payload", "value": "ca74be96ad12fb851190d64bfe03ed6b6ff844eaffe143ff6d2c0154602615df7db54774013655925dd9081417472e04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786417005, "uuid": "78ca2f4b-6038-4a9f-b35c-f2f0cdcde80e", "value": "T19833076727230D23C0D55175A2E34336B6FADB4A28B88A5778A0AFDD5F485E032533BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786417005, "uuid": "671b3062-cd6b-4b95-917f-ed67e5e694e1", "value": "768:CmSEpPpxFxcyzpwTUC89IDbk2sO+CXG9IN7tM1x1jbz:wTmIyX6N7tM1bjbz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786417005, "uuid": "d5a2fef5-56fb-4483-9560-66d5ce5d0d90", "value": 53752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786417005, "uuid": "55511017-0a26-4349-8317-31af18d2bc41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786417005, "uuid": "8f0684d6-5994-4398-be61-b878814f02de", "value": "main.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aff81e8-956a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786441918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441918, "uuid": "90b0da2d-f3d3-44cf-89b9-622b3461c5b2", "comment": "Malware payload (Mirai)", "value": "8ac542333c2a4519fec00ca4902ce2d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441918, "uuid": "ba09b97e-1c39-446c-b955-cfcd27fe48f4", "comment": "Malware payload (Mirai)", "value": "7ea9dd14686e93bfa47047162b0892e721e4e4c724bbca6cc794198d2e7b7602", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441918, "uuid": "09c664a6-9052-4376-b5d5-7e35ee4b35b2", "comment": "Malware payload (Mirai)", "value": "779170a96e7be59579bcac5b0b858e006a59446c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441918, "uuid": "6bbc6aa2-a1f4-48fe-bb48-bde5e03a9a6e", "comment": "Malware payload (Mirai)", "value": "30a0494599d39696b85baeda75fed14d1ff63fd0662b44c60f469e52cc8a31442214d4c39843e69505830fd690cb7482", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441918, "uuid": "b33f344c-faef-42c5-9c74-fad16cec2a22", "value": "T136146D46E6414E23C0D61779F6AF02493332A7A4E3DB73069D28AFB43BC675E0E63645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441918, "uuid": "e8ee8afb-a58b-4955-bafa-53ea89f43bd2", "value": "3072:mmEnp4cnSyz81FjSdfWaEfmp/jlVNn9ZD+iamXxnePTUi/M/95OqeH:mmEnecnSyz81FjmWaEfmp/jpnv+TmXxA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786441918, "uuid": "7b54c9a0-25c9-487e-8f34-08f2c13a34ce", "value": 196446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786441918, "uuid": "27b75481-ca49-4765-b71f-cdc1ac0f0199", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441918, "uuid": "c56f155a-abab-4bb8-8d1a-7b6700c91f33", "value": "Mystic.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afba3f06-95cb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786483748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786483748, "uuid": "e8107098-40d0-4f29-8e92-96cf15f58834", "comment": "Malware payload", "value": "eb2a9e1d87ae40d223c73881073d5aec", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786483748, "uuid": "685e8343-832d-4429-af23-7279a6295fc9", "comment": "Malware payload", "value": "7edb6da23f65ea88e42e18d72268cafd01919304a04692f8c428ccc731cc95de", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786483748, "uuid": "2d41e2ed-ee78-40a8-b9a7-0c1a5a52dc29", "comment": "Malware payload", "value": "0982f6ebd8430dab081e0cf546db1be3d50dfe1c", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786483748, "uuid": "d51c9e5d-30bf-4329-9586-f6e910d2b649", "comment": "Malware payload", "value": "d8f32ffea1ca8fd93506ce8484d67482ea31fc5c98a5326354094d470b7c4241859949da57945a5fd25041a344a5c50a", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786483748, "uuid": "e2f647b4-8a82-4ff8-af3c-bf16ec30b3d2", "value": "T100C412178264707BCEE3DF3D0F820A91E90C546FEC5F4EA49F4B16EA301B6EA694605D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786483748, "uuid": "76144406-98cd-44d3-b9bb-fda804b89d9d", "value": "12288:6VcxvHttJZMQphfu9B95S1UdmJXFZYekqqGrfYHcnrutTKZtwapFT:YsHrJZMQ2zu1U8JVNkTqwHcyBKQaTT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786483748, "uuid": "6b012bef-289b-41c3-8514-acc08ffa36a3", "value": 552834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786483748, "uuid": "89aa9eb5-5f2d-4793-8320-96a38159f18d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786483748, "uuid": "d1657707-0477-464e-8b2c-b369b0d26820", "value": "SecuriteInfo.com.Trojan.GenericKD.81088776.8829.16530", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c106630-95c7-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786481890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786481890, "uuid": "e311ea13-0e24-4913-b373-161d20733fcc", "comment": "Malware payload", "value": "1c0a1fcb9b614bbc35fe3e543dadefa3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786481890, "uuid": "4bf45c96-cfe8-4c2b-ae2a-9caa6af02b02", "comment": "Malware payload", "value": "7f30921c475826c0e47a551f08a2924810165a2992f1b791aeb2b2af71092aea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786481890, "uuid": "3afa0a01-b939-4ecd-b102-902346403b14", "comment": "Malware payload", "value": "5727acc0af3ed4be5b9801dac6d6d5916aa199f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786481890, "uuid": "6e387498-e385-43ff-9083-4a5790e4aefd", "comment": "Malware payload", "value": "600b7fb755072cf2a568fd7f42141188fea9701add18a9b7c3b7cc6ff8743b5e5c418e2dfec8bd0d92b7379d4fd7193d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786481890, "uuid": "76339394-5718-40b3-83ee-ca8bf457509e", "value": "T1F563411AAF619D77D80FDD7301E8860124CCB49752AA2B2B71B0CA7CF79A98F05D3D94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786481890, "uuid": "65e20e10-aba8-467a-ae99-4cd9351d05dd", "value": "1536:nTNAwRDGC9IfmtS8lCKSS/PoTpmBTIm7:UKb7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786481890, "uuid": "6d6eee01-f42c-4b66-8774-6e698a740dbe", "value": 68512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786481890, "uuid": "55adc3d6-9649-47bd-954d-d0b7fdaf0779", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786481890, "uuid": "9c4178ec-027f-4698-bcc9-8c23083c16a8", "value": "main.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f2e1a4b-9556-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786433281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786433281, "uuid": "2e4523cc-b4df-4824-bd83-cf7e86ebe60d", "comment": "Malware payload", "value": "a64b1def801efc76df9eae62c9aecf0f", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786433281, "uuid": "5d4dd808-2eba-4159-9ea5-af86f2028720", "comment": "Malware payload", "value": "7f58240ef2d9bfa9851177424d65b07be925c6b2fa334e12dd5272b2edd63659", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786433281, "uuid": "192ade7b-e6b9-49c4-999c-7f782e06a96e", "comment": "Malware payload", "value": "9062268a728d69832200c1f111fc96c685944f77", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786433281, "uuid": "ae299b3b-7ad3-4c9d-be22-412008b5847d", "comment": "Malware payload", "value": "214d0522c3eb6700e00ccb6214b5a701ee5f5197c7b17edb474f58a7748a58d2a8c267be118344fe4128b4ac92aa2efe", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786433281, "uuid": "214f0f57-2d7a-4fe9-a43d-cac600224a41", "value": "T1EE151202FF455A76C69613320FA760C6E61CFC67AF22990F2302732ABD777D1C96191A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786433281, "uuid": "6e130565-48f9-4eee-8542-be0c9e9626fd", "value": "24576:nbLSv9k7YKYt1QRT/64rmaa6TOrw6/YI+uq:nbL3YKYtmB6Ea6KrTAI+3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786433281, "uuid": "6e479916-2063-4833-a547-3e648bc96467", "value": 875008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786433281, "uuid": "cd4baf2d-1bf5-4186-8ef0-595a7996350b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786433281, "uuid": "08a01ea6-1888-475d-bea8-549c3e01d4c8", "value": "PO-20333972248.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9290741e-9573-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786445903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445903, "uuid": "c1403510-211f-4da9-b6c6-63029b5840f5", "comment": "Malware payload (Mirai)", "value": "f57bbd2fa57cf1ec6ddad7a497166167", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445903, "uuid": "ad4ccafe-b502-418d-a29e-59da17b719ab", "comment": "Malware payload (Mirai)", "value": "7f75807a539e98b59db8217a8ad2a1616ca4cca1f734cea61b27e70aa62354f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445903, "uuid": "857d11cd-67b5-4d90-8a86-6816e005f033", "comment": "Malware payload (Mirai)", "value": "18be9845db063bef44077aa0e6480867139cb3bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445903, "uuid": "04952319-6761-4cd6-bb6e-45d5748f9349", "comment": "Malware payload (Mirai)", "value": "7f86e95daee26db26084d04bcf1f9eebf1e9bac940e40928742d364860f6c279ba385f2ebee7e85deb48b41359c0c9e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445903, "uuid": "7e8afdb7-afdc-4522-9c87-b345e122d13b", "value": "T1ECD37CC6F683D4FAE88209711077E7329F32F139513AEE46D774AE32DC51642992A39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445903, "uuid": "277246ac-f68a-463e-9eb0-856ad648154e", "value": "3072:vMnUY33M6M2I5Sua3+ahXdaHUbCBgaEr:0UY33j0sKEAg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786445903, "uuid": "f8338269-3eff-44e7-8258-8f4732e47b13", "value": 133064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786445903, "uuid": "753bd148-4dfa-453e-b4b8-29d46e5b3e2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445903, "uuid": "b60428cb-12e0-4da6-bd2b-ddcb15d75bff", "value": "sdfjgnjsdf.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d37af48-9597-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786461222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786461222, "uuid": "7ab19246-6f55-4fc9-85fc-f698ef1031b4", "comment": "Malware payload (Mirai)", "value": "cf68bc11bfe0d900aa54f853164d9b9f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786461222, "uuid": "a9cbc99f-cc44-492f-8fec-aa7fd6dcb16a", "comment": "Malware payload (Mirai)", "value": "7faa69f45b42fec2d8025af4eaf464c68d500f942d387718c92ed0b15bd953bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786461222, "uuid": "112fb299-08f8-47ca-b669-e49749f85e25", "comment": "Malware payload (Mirai)", "value": "9738cd938b8d83eabc42effaf91e43a27cb7b3a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786461222, "uuid": "f3bf006d-fdd9-41d9-8601-cf9d80fe3231", "comment": "Malware payload (Mirai)", "value": "679058beaa753ee6a828535a31789e9022b137c493b8f0e6961f967ccdf9ebbc2f95cf4d9a5a70ac7da3a66a5d99e464", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786461222, "uuid": "1d244684-c3f0-476d-b873-72158f57d9e1", "value": "T1FCB35BC4F203E0F6DC9712B1117BB7739B33D0765639EA02E7652525AC62B909E0BB6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786461222, "uuid": "f1f460f8-3376-4508-a936-ece636d55579", "value": "1536:hclYGWpQHhxGeZLG5N0RCT+JHyDh9yUPJ43pXSoZR0S:hclYGWpsXGeZLG5NECymb3R45i+0S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786461222, "uuid": "31046208-bb8f-4a4d-b32b-6c41dd4c4e7f", "value": 109096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786461222, "uuid": "6d76e1a5-acf6-4f9b-b3c3-2e221da6b940", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786461222, "uuid": "945deaff-10f8-4d58-89d7-777217e80a38", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a5176a2-9591-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786458694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458694, "uuid": "69bcdac4-bddc-4145-8ff3-93f1f09cb01e", "comment": "Malware payload (Formbook)", "value": "9b2837d0cbdc9a940632a801a7b410a9", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458694, "uuid": "212381a8-d9d3-44eb-927c-fb5885c54299", "comment": "Malware payload (Formbook)", "value": "7fbd90ecc017dddf16fc3e56b2d058b46df9f07bd7a3f6c7731d270e7059a179", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458694, "uuid": "02b3b8d6-74e7-44e1-ae36-9d72d0d28fd0", "comment": "Malware payload (Formbook)", "value": "00d29a50b507428e6064fb9168a18541ed9e18b0", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458694, "uuid": "43060339-1799-4c8f-aba7-e18ba49528a8", "comment": "Malware payload (Formbook)", "value": "d4ab78294dbc8fba428ba7bbe9c33d29c77be24536a5a95c77f85d0b5882ac56c828275b33037ee6dcd177a7cb1b663b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458694, "uuid": "49f9f384-129f-4d62-a267-bdb589c790df", "value": "T13BD3444A9ACB38445337673FA72AACD4EB3607A700500907F47CA696AFF1D16D9E0CB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458694, "uuid": "bf1f9afb-1d09-47dc-825c-2e9e2d5ec76c", "value": "1536:4nMGBuqUktUQ7qodi5c0i5lp09C5+F1KVEgtQtjZ2zgGdNnAch9XXfL:kMGBuUU+7qH1KVEgtAZ2fA+9T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786458694, "uuid": "fe4fc39f-51fe-43b2-9bbe-3b84675b4fc1", "value": 134614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786458694, "uuid": "bfa6bf1c-1cf3-4672-9eab-0b22237419af", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458694, "uuid": "5f648ed7-41ce-444a-94fc-fa32332af7ef", "value": "Company-Profile-MokkiGroup.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "065b8d05-956a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1786441803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441803, "uuid": "7d2f3437-2f5d-46d1-af99-37c7318da502", "comment": "Malware payload (Gafgyt)", "value": "51e9d6d4912fe1dd2ca842c69247f336", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441803, "uuid": "2919e4dd-5f08-4666-acb8-f36a6e2dcba3", "comment": "Malware payload (Gafgyt)", "value": "7ff2375f3300ce58ae4f6058d98481b3004489b1d781403c2fe9b58d63283c6c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441803, "uuid": "92962a70-482e-4450-8ea9-ba41611f0802", "comment": "Malware payload (Gafgyt)", "value": "1577db2397fe66280452e44c2256dcb9b64345f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441803, "uuid": "612a3c46-23bd-40a4-8340-671f5e7406fc", "comment": "Malware payload (Gafgyt)", "value": "8f9bbb849f38469ea92a4e0fffa09fa82d5e82a7c29073e520f7fdd12f4db667aba4087222dcbcfc1626458e686a5465", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441803, "uuid": "bfb74eca-0dd5-41a8-b09c-d17c2431c767", "value": "T1F5B32A44F841876BC3D327BAE78E478D3B315A9457DB33116A38AEF42BC17992D29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441803, "uuid": "5dfea691-bb6e-4bb2-8d94-2254663e6909", "value": "3072:ghRUKoPkU2/dNFRwH+BVhwnT7V6mVJTQwOPHCXQ3o:gIkU2/dzKeBXwnfV6mVJTQwOPHCXQ3o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786441803, "uuid": "d3ec532d-4c0a-470d-b2a2-6bb2b34eb3f9", "value": 118162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786441803, "uuid": "ff3ab871-376c-4b3f-b19b-46bf4a40afd8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441803, "uuid": "2890543b-e8ad-4441-9eb7-16ce8afa8f2b", "value": "a-r.m-5.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80833ac0-9579-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786448450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448450, "uuid": "6cf9865a-b90b-4de6-81a4-d66a029e321d", "comment": "Malware payload (Vidar)", "value": "28215c431409c8eb512d3657a2fb2a9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448450, "uuid": "4ae15249-530b-48c3-8ea4-52edb2ebcef9", "comment": "Malware payload (Vidar)", "value": "817f0170063e9df2cd40bd05e6d9d2f5ae112fc4ac528fc3e9ea4257e79e29a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448450, "uuid": "789c6824-d09d-436e-9f21-806083c13025", "comment": "Malware payload (Vidar)", "value": "b3902911149346e000ec517bd5e83d3f76f1db89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448450, "uuid": "aa5a2df2-92ee-4e75-bffc-300cdd80dda4", "comment": "Malware payload (Vidar)", "value": "e0c031cf63660b8e8d888529095c4831598f118f27566a9c3fca9928d0b90776fb76819b94372e5b0cedff2cdb33fe51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448450, "uuid": "7d110df2-c7a8-45b9-ba71-94c79bee6fee", "value": "T132168D07ED810DB5D0AA623249B386923B3DBC451B3267D32F90B73E2E36BD06979754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448450, "uuid": "e13f37fd-d841-4a9f-beba-ce238cab81ec", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448450, "uuid": "07913727-fe2b-4b8f-beeb-93fe1ab5177d", "value": "49152:Cywvfx5L/xdqw8Jo38Hk18i/47f8xfwaA4nNptLe:CnKPEiiFvN3Le", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786448450, "uuid": "a8bcaf5e-396a-4086-b55b-663e9922169d", "value": 4074784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786448450, "uuid": "0a144e61-6153-4855-b5f8-e5b6b8bbe484", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448450, "uuid": "6ad027e5-2129-4c59-a2bb-0753b33c2a3e", "value": "817f0170063e9df2cd40bd05e6d9d2f5ae112fc4ac528fc3e9ea4257e79e29a5.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1870ab7-9591-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786458813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458813, "uuid": "f0e57162-d713-4408-9826-3559da5e89f1", "comment": "Malware payload (Mirai)", "value": "156070ee7dad095998f0a17887d30e69", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458813, "uuid": "ef2b8173-992c-4de5-b3c2-e924e5e4e799", "comment": "Malware payload (Mirai)", "value": "818a43c727c3240d8d632dffc6a07d11e05dd0354a8aaca8d4c561876fb6c740", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458813, "uuid": "f977eab6-3f7c-4421-b65e-ba91b0251990", "comment": "Malware payload (Mirai)", "value": "c79797fe7d199e1ca594b3b95b4be27eb39c7633", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458813, "uuid": "6599b101-23f3-4140-b952-741921a3e4bc", "comment": "Malware payload (Mirai)", "value": "fc0bfc8489602a1a5791b7320e562ab5dd4ade4420e09f6bfe98ebc91e4ab30cf1cd6a18f978d56f17d0202d215365d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458813, "uuid": "469a6127-5b46-4f67-9e90-440e640614cf", "value": "T16504AEE7F2072592C81506F807CBBBAC2A6720115EBF95FB6C5E333B69664CE59123D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458813, "uuid": "6c57d1e8-a8bf-4ac6-a2a2-3c6b5fef3f7a", "value": "3072:luzP80p5/76i6/j6dF+qtBySntQbn2JlaH/Gs7r7NgJCfW5i+Uq:luzP8G5ju/udU2JETv7WCfW56q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786458813, "uuid": "5f17397c-7c03-4ec3-885f-3eb0c8f8b9cb", "value": 173340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786458813, "uuid": "099eb99f-8f75-4e27-956a-265f965515cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458813, "uuid": "f2eaab17-4c21-4f13-ba1f-15284e0d9bb7", "value": "sdfjgnjsdf.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8da288a-9527-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786413406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786413406, "uuid": "36c10159-d903-4f46-8d99-f42621bffcab", "comment": "Malware payload", "value": "16a657f76344a4cb0fa2648a6130e9dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786413406, "uuid": "e137616c-2f9b-473f-9980-c1ab9575a435", "comment": "Malware payload", "value": "81ad7c9495e9299aa17bc6afcafdbb1f0484abf1bba0c268258eb0854d1053bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786413406, "uuid": "77dffccd-4e21-41ae-afcb-d7faa0e2c13b", "comment": "Malware payload", "value": "de329e81139935dc1faa272d2898cfa8f6187810", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786413406, "uuid": "ce54e3f5-09c7-47a2-911a-5706086de331", "comment": "Malware payload", "value": "387d5bc5aa342fdf016eccea3a668043eafd2e5c45c834d084fb83a1f7206e3e6d0a60cb7d9ea251c18cb4c592f35a58", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786413406, "uuid": "d14f3318-e995-413c-a7f1-90b0b96eeafc", "value": "T150C44BD4F2C65E7DF00659321B83DB1AD6126FD2E3685BAE852507492C8CBDBCF32168", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786413406, "uuid": "b056b9d9-16cf-4b70-abd4-ccede263efed", "value": "6144:0qrxkmEaloWqHCIiVkrM/rdHcYvinohtN5gmzo/geXYQuiLMDwDd1c8QpZSbWh+i:0+Kas3i/+YG2RzooNJwD9QpZSbo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786413406, "uuid": "954e89b5-4a9f-4bee-9060-459610e0b241", "value": 566980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786413406, "uuid": "6feecc2b-09a2-46ef-9c5b-cb94a4e476f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786413406, "uuid": "a214ccfd-54f4-4aa4-87ad-6ed9f1cf4860", "value": "main.nios2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f8778b8-9533-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786418276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786418276, "uuid": "13498ac2-10af-4654-a873-133ecaa0fcf1", "comment": "Malware payload", "value": "de01abae8e5f486677183b95fb9701e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786418276, "uuid": "2f67ecce-b9db-461a-bf9b-ff999ff0c73e", "comment": "Malware payload", "value": "81cdcd2b0f68a8e93e767282253a60ec9c33980fab150b834f3ed405c73a8ccc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786418276, "uuid": "28142c24-851e-46ab-a1ed-c50a3d01d265", "comment": "Malware payload", "value": "6eb5785f9fdb00712395e214d8ba6f7b8df9829e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786418276, "uuid": "625bba1e-5c9e-480b-8b31-c101ed61e006", "comment": "Malware payload", "value": "33b0ba14d9e34cb2c18753e364b686f8c3856f2fdb386e935862c3d7003a717f40baeaabacbbe8edcb0371302f25b851", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786418276, "uuid": "ed6489c7-506c-41a7-95c0-22e55333cf80", "value": "T1CBA3970E7E228FBDF269C63047B74E25976923D727E1D685D19CD6001F6034E682FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786418276, "uuid": "53e133d8-4623-4ed5-8bbf-b34876553ce2", "value": "1536:ll03N4m0HYRmgFTpqv8Y7rLxxPZJTXfxX8MY/FeyPNDxsryto+:nkNr0YRH1qr3rPxX8LZls2/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786418276, "uuid": "0a8e139b-5716-4464-b486-7cb084bcaa38", "value": 105460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786418276, "uuid": "17637a7b-41ba-4a7c-ae5b-15e33bfd9e24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786418276, "uuid": "26ad4b5f-a8a3-4d18-b385-d63da9f4cb37", "value": "lul.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94489c0d-9588-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786454926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786454926, "uuid": "52484df6-fd87-4412-a5da-dedfd2ed0cca", "comment": "Malware payload (Mirai)", "value": "080cf6844e8146669d3bc25022269705", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786454926, "uuid": "af692041-50cf-4789-bd32-652b36f80743", "comment": "Malware payload (Mirai)", "value": "8217c71bb455895cf4bf3824b8084449157b7a7e1134f8011c186191943485b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786454926, "uuid": "8493c164-7601-48dc-8b86-67dbf1e0a199", "comment": "Malware payload (Mirai)", "value": "046a0ee3e0f7e73c3a902a886ad319d20f5c54d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786454926, "uuid": "0fdb7db5-ad32-4e31-960a-852e53eac72e", "comment": "Malware payload (Mirai)", "value": "dc0145e54ebf6dbfedb6b93861f940aaed9dc59bc1fde4b1328b76de2eab9e56918a160fb95b5f19b7ffe213468e6d60", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786454926, "uuid": "19d42ae7-58be-498e-816e-8499265e875b", "value": "T124144BC7F900DDBEF80AE73788134905B130B7A214925B37B257797BAC3A1990977E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786454926, "uuid": "47b68579-a102-41a9-99ad-6585c26a64a0", "value": "3072:VcRDDs3KPqJBPYh8hgTHVfvqhT9Ur6lUOhDrW5bV0jbiqLjGvIMyLN2R1U:mRHs3AqPPG8UyhT9U6JPW5KLjsyLKU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786454926, "uuid": "bb71a37f-d15c-4aad-bfbd-029c8c3eab40", "value": 191520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786454926, "uuid": "81c585c2-80b2-4c8c-a326-0dbad5c795b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786454926, "uuid": "8afe4268-9d5d-4874-ac87-7ce312ca6272", "value": "8217c71bb455895cf4bf3824b8084449157b7a7e1134f8011c186191943485b8.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "609a627c-958d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786456986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456986, "uuid": "249822c8-eda2-469f-bd94-5e36364e968c", "comment": "Malware payload (Mirai)", "value": "1c5327d91d9f0e2c9442e9b207ad52eb", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456986, "uuid": "a60eb3de-4233-41d6-a8ac-2808dbb97a7d", "comment": "Malware payload (Mirai)", "value": "822afb0c64c1395280a354f56e4b63d95d0090489b31638855eed7f249f4108d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456986, "uuid": "f4bf3776-f4bd-45ac-8ee3-41341b794787", "comment": "Malware payload (Mirai)", "value": "5e4ea29b17a0955f53dd4a2c3f324fba2c3c1e94", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456986, "uuid": "57dc8a42-faa3-4099-8412-eec57c76ee14", "comment": "Malware payload (Mirai)", "value": "79915ba0d51efd5d53136397cc89776ef9e8534bb9989b9335d1dab4258fd6303ad188d77faffd8e693495f58664f0ea", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786456986, "uuid": "d6574b98-36d8-449e-af9f-91460a91565a", "value": "T185F0A7C512876FB1A02EAC92B30399B0F201E1DE58E70FC44F09AD249859400705CE4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786456986, "uuid": "7dcfc795-ce5c-4610-8cd6-6f7d36861ab1", "value": "6:B9Ii1rK5AmvVP5f5AmvVNsK5AmvVXVV5AmvVKf5AmvQ:kir89vVP5B9vVS89vVXR9vVKB9vQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786456986, "uuid": "9d03eb06-81e9-4459-bdc7-c40631e3c6b0", "value": 438, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786456986, "uuid": "c120c734-b51f-416b-9a0b-d7ca6101632f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786456986, "uuid": "261dc5df-34c5-42f5-9a03-e3740c403043", "value": "toto.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72d0e978-952a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786414497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786414497, "uuid": "7733350a-6e1f-47eb-82ba-0f3bbbe6b05f", "comment": "Malware payload", "value": "e4c6c3e8931b3ca18f98e0a507046024", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786414497, "uuid": "6553b8c8-4148-4f88-b61b-97c443972b35", "comment": "Malware payload", "value": "824f9626e070519b3bfff42ecf6876cb48cb0dbf1431702db3e18a5dd923b1ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786414497, "uuid": "32d75d61-8045-4d3e-bf8d-4ce1fdcd86bc", "comment": "Malware payload", "value": "a9bb58e9986986f36bf5e26c75f2b88be110199d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786414497, "uuid": "eb4defa9-1c6d-4852-aabe-5e14ad4f89b1", "comment": "Malware payload", "value": "ed988336650009a1ab76389622ebc27188c27989cad43cc7b9261b446039e8b2ccea3b34ea18fc120e89c6c04d0a811b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786414497, "uuid": "2f1e3f13-b234-4f80-a615-d8feac9cbaf1", "value": "T177530817B5E3B0BCC297C0744A5A99F2B931BCA106213E3F97C8FA312E35E412659B71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786414497, "uuid": "04d3df62-357b-498b-9dc3-623b8cedc018", "value": "1536:o2vChs3CS7EN0r/L3mkyZenGe4FhgV/78WY3JUr:BKhSg0r/rUe+hmyW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786414497, "uuid": "28335f5c-c3df-412d-af53-60b0fee29db9", "value": 66640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786414497, "uuid": "d9804cd6-d6ee-4971-aa4f-240362b09d39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786414497, "uuid": "f6ec4287-e897-41d9-8c7c-f9523167c68f", "value": "main.x86-64-v3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15685827-95bb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786476617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476617, "uuid": "a416c712-26bf-4825-933e-c43f0051725c", "comment": "Malware payload", "value": "8d4e753db0c0f550fd339a8854ea5096", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476617, "uuid": "22257537-952d-493c-b9f4-e983eb0d73b3", "comment": "Malware payload", "value": "8268dbcb637ca538d2ac2b071c35a15ef84e329fda44dadcfa36599ca2eacad8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476617, "uuid": "ba8774b8-bf2b-4ad8-94fe-4ac0023d4fb7", "comment": "Malware payload", "value": "7ebaf183dcaddedd4eda88ec8e1be80c9f3e35a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476617, "uuid": "a1b2bd66-fbd7-4268-b0a4-27cb1223ce07", "comment": "Malware payload", "value": "637a8fa2da2e542c0a538da21cb8f12ee4c948d7095d625d90e7d537bfe2da87d2e7979c3f72da7c2ab33b185fe7e07a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476617, "uuid": "047c4f16-01e7-44f4-9116-59e57ceddda7", "value": "T1C6366B03EEA548F9D296D73588774242B764BC499B3533D32E60BA742F363D0AE79B40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476617, "uuid": "d6a140aa-b32b-4381-a28f-56aaebd4530a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476617, "uuid": "87547e4b-3846-4d18-8d31-f36e1b6aa0aa", "value": "49152:uFKpz7i7FAlc03DCBGcm+a1h6TczyJPj4RRHrYvAaas:uc3XND1aJrCOks", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786476617, "uuid": "781ec4ce-9a8b-4040-a8e6-45ac55346f97", "value": 5002255, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786476617, "uuid": "4d25e3a5-64e1-4782-b0a7-4cb24354e577", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476617, "uuid": "4cc44fea-bc09-4af0-a941-398d87377847", "value": "8268dbcb637ca538d2ac2b071c35a15ef84e329fda44dadcfa36599ca2eacad8.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1633c53c-95c8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786482202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786482202, "uuid": "96151936-075d-416f-a26f-4afd2b6c801f", "comment": "Malware payload", "value": "319442e3707a5a476d55e96e38cf7139", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786482202, "uuid": "8d49d5ba-f4eb-4557-800d-580add5a3065", "comment": "Malware payload", "value": "826d72881512203a510f87405abe33d1e0c910e194641a22536ac36dc4edf173", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786482202, "uuid": "e1d99f50-a4dc-410d-b9d1-5dadd9aa6277", "comment": "Malware payload", "value": "dffcd34f4849b8ad129ca01febdeb95529bf13e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786482202, "uuid": "b11c7c2f-469e-4246-96a3-68652a404fe7", "comment": "Malware payload", "value": "0670b196f7eb0ad41f584f193a954dc3075c7eadc678ea251d716e8b85fc9816920f5865757b5a242e6324da6e3e9501", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786482202, "uuid": "03ddca7b-cc99-478e-a37b-35685b177249", "value": "T11B63556A2A21EFFDE16E823047F39E70975526D236E1C280E26CDB085F7028D589F795", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786482202, "uuid": "d213421e-416d-47f0-9f20-609eb2d2c1f2", "value": "1536:LjKb45JBHVNPcS5lp8vQX48qjhzTvJMMuXyu2kMD:W5Nd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786482202, "uuid": "3452d96b-6a2f-446c-88fd-46c94f0cd00a", "value": 68480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786482202, "uuid": "1a2ecd29-44ae-451d-a011-0b425cf94658", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786482202, "uuid": "c38cfba7-7d67-48b7-bfb6-ddc65ade40e8", "value": "main.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6810d8f3-9550-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786430800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786430800, "uuid": "330ddf12-d03c-4389-a7ac-85d565829b7d", "comment": "Malware payload (Mirai)", "value": "f12a8bb360d0187eaa5c80c2a98c2730", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786430800, "uuid": "555d0a52-f259-4a97-9107-bc232666f9db", "comment": "Malware payload (Mirai)", "value": "8287b91e84ee45a596f4345f311c112a6b860d33b419b9d00b7329f4a742849f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786430800, "uuid": "2362d784-3ce6-4341-8594-24b794f040d2", "comment": "Malware payload (Mirai)", "value": "e30566f58f2161d40cd70dda34472697268f0bae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786430800, "uuid": "a65da186-b271-4f28-8cc3-aaf71e49fae5", "comment": "Malware payload (Mirai)", "value": "fcaf9dcdbd2689c49099b0ba0173be5858a52e6228f3eac6130b9eac10b81f26944cbff27c9dc9108032bd6ae3412c70", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786430800, "uuid": "d42c6b0f-5690-4446-a5b2-752b2d362c41", "value": "T17253F132C32B4B58D6BFF9396CEE76550E689FAA1480E952E0D471330473B215B1EB27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786430800, "uuid": "519b006d-03f5-46b5-af5a-94be1ff2e8c2", "value": "1536:cNq3wMVTm9Z7ClBtKjEOz5YfHsiwqrTzK10SwSXnouy8DMW:LgMdm9Z7CCE45srM0t8outDMW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786430800, "uuid": "d6c32079-e02e-485f-9db4-9bdf153691e1", "value": 64444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786430800, "uuid": "46ca1a36-5cac-47d3-82cf-b02673951787", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786430800, "uuid": "7bf0bffa-3720-4bb2-bce5-4d3af724581f", "value": "putita.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bb5e66c-9579-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786448496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448496, "uuid": "7101153b-d36d-40f0-a303-46b592a3c9d8", "comment": "Malware payload (Vidar)", "value": "659a177d7be0d9331fa0ba2653b68341", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448496, "uuid": "a395f3a3-623f-42f1-846c-870a19f5c958", "comment": "Malware payload (Vidar)", "value": "828cc744ce5456f09af781db4df9dfdedbf451a7cca9d7c3ed65b4f6ea4f3a0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448496, "uuid": "90ba10f6-7a00-4d85-9e9d-baa7d1dd0e5f", "comment": "Malware payload (Vidar)", "value": "8babc9b5ce204dfb32abb57d40055461927d940a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448496, "uuid": "9130dab5-bd39-41cc-942f-2069f617c4c7", "comment": "Malware payload (Vidar)", "value": "97ff7d2ab484344bcc4de6a73d3314811f66985c1dcdad8e2678c1350428f9f28a078ad61193f2cba59b18c92e2da5c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448496, "uuid": "41bf4781-ce8c-4da4-b88c-7980718590d0", "value": "T1F3067C07B8A10AFDC09A733186A2B6563F357C940F3613D72F52BA642E72BE05D7A744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448496, "uuid": "7ee68e5f-110b-4917-a0d9-f2e0ffe69143", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448496, "uuid": "84b2dcd5-9c12-49bc-ba69-624324d3a8b6", "value": "49152:aqQZjvYH7tPfavPIz3b2Yvug1dJEse3JixERuj/ALZuQhuFic3:atOTL2IJc4Iddq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786448496, "uuid": "bbececde-13e7-4baf-9d5a-e36f2758f598", "value": 3897720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786448496, "uuid": "e4c27ab4-7968-4b36-aced-c19db83c5663", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448496, "uuid": "24e3cc33-90eb-4d28-bdb3-5b71722997a1", "value": "828cc744ce5456f09af781db4df9dfdedbf451a7cca9d7c3ed65b4f6ea4f3a0d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e4abadd-9562-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786438622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438622, "uuid": "09a64fc2-bd68-4963-9ee6-6d9404b49ef2", "comment": "Malware payload (RemcosRAT)", "value": "472de4ba6de86197fd17dbb0ec83fd49", "object_relation": "md5", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438622, "uuid": "47dbb50a-ec66-44e7-9a0f-0c04dac79eaa", "comment": "Malware payload (RemcosRAT)", "value": "82a611a9123c19e8c9d64672ffdcd2f9a1adadd5616cddc48953f67c7ed189d7", "object_relation": "sha256", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438622, "uuid": "ad588a10-6d20-43eb-b9dc-775c8a878128", "comment": "Malware payload (RemcosRAT)", "value": "5e21a3890e1f6b2ba275a495f81d5d45de141b8e", "object_relation": "sha1", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438622, "uuid": "a17ccb49-320c-4232-a3a4-7550a43c0f40", "comment": "Malware payload (RemcosRAT)", "value": "642a9370586604ede0b25025a8ef53b6d98e2d11a785b920b10ecb1f9efab2dc6300d6d0ea80e8fc280b5c9e6d2ad996", "object_relation": "sha3-384", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438622, "uuid": "6b3ac187-043f-42dd-a115-e2867b6f0ae9", "value": "T1A81753E46D579B249D78204F2B101D6CDE6B2A401CEFBE4C6E9B6C2B5CBA31A713413D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438622, "uuid": "02408f18-d333-48c3-8996-d57187f91b01", "value": "768:3mQmz/LKgL1lmg2fbCs5uhyme8vfwZUuVkhxx+8EwMsXW915q5gBdjimHG7germ3:dY/Ds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786438622, "uuid": "2a887197-5420-437c-b0ad-367090887ec4", "value": 18898682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786438622, "uuid": "ee444240-fc99-4f7d-a957-5e03cdb0b944", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438622, "uuid": "093c671a-96ef-4f8c-a57f-4969461481ee", "value": "FedEx AWB_no 530526.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c36ca6f-9591-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786458697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458697, "uuid": "e3c421c1-f5a8-432c-9ff8-5254a61c9daf", "comment": "Malware payload (Formbook)", "value": "980214a1784f387674e051653db38e05", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458697, "uuid": "abcee528-674a-48b5-a4eb-f79197f5f390", "comment": "Malware payload (Formbook)", "value": "82bc1032c149342904f94f786811d29e697e1e8d6c007229d74067bcad0a8013", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458697, "uuid": "ae2970aa-8916-472d-bd87-381a5c891c9d", "comment": "Malware payload (Formbook)", "value": "e33a0103ae232b05b218f11bb5e330cbf7576fff", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458697, "uuid": "b298fe7e-5434-4039-b1b2-d6ff08147b6d", "comment": "Malware payload (Formbook)", "value": "35cbf3c247ea7568b24aea9f52c2b4354c65d140741f5ca78ecb6dabff8749b1018529233b78fffc05b9d168f7588554", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458697, "uuid": "9dd686fe-9a00-4c42-8fb7-b5e60ba22ece", "value": "T1FD56C6B272CE7696055C3369984D4C690F16CC281EC376E8F0DB87C8AE0F5D265989EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458697, "uuid": "b5ef6838-f102-4f29-bcdc-b57236bbbd71", "value": "24576:IOQj01Zykhje26IYARbz+x+GEnKMAOQj01Zykhje26IYARbz+x+GEnKMX:tQjIQjY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786458697, "uuid": "f456ea7f-b345-496f-9b0b-0df0874c6879", "value": 6131689, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786458697, "uuid": "199970c7-b378-4e3b-b917-08abf141cd7c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458697, "uuid": "b310310b-f963-4e38-b518-335bdef6447f", "value": "1-26-QTN-09345,pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "201db27e-958e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786457308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457308, "uuid": "34826333-9d41-4740-8f0e-5b5eb8c8d4e4", "comment": "Malware payload (Mirai)", "value": "ad37db6aaef07bf517f3f92bcd99b518", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457308, "uuid": "d1855c8d-1eb8-40f1-ac56-cd12f85a94df", "comment": "Malware payload (Mirai)", "value": "8324043f2352f431d636e8c0f6074ad77f34f9b00ef7c1e780b227c0b5449778", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457308, "uuid": "c901ffc4-9b94-4cb9-b808-32e2ddfcad85", "comment": "Malware payload (Mirai)", "value": "bcd36ca42c5e877227d7105304af6c33a8a0b88a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457308, "uuid": "a4d12262-033c-4dac-968c-1c40eae481c6", "comment": "Malware payload (Mirai)", "value": "e8bcc5a99b4834bf9c16ba402a5c30ca28f2ddb27b8e3e18a333b0e92b5aabb8b384f853a38fdf336f9dfac595dbe9f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457308, "uuid": "94914e01-47cd-46ab-93c0-152caf5c9281", "value": "T17FD1B6577F45CF2BC88251B2F79A8324BE19AE0AE6EB7343F222BFD037051D20669514", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457308, "uuid": "1afeb53c-92e9-4946-b5aa-d2e33d905314", "value": "96:wXhDDwOVU0HMR2WIF/3A2zDX33GNWx737vd4gvb+14mwhZx4ekZJR8ROC5aM:8wOrHtwYLGMxfvdkEZx4eCe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786457308, "uuid": "a91f9b00-f448-4dfc-9eae-a0ee898ef7ab", "value": 6620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786457308, "uuid": "e1c0a109-2538-44ba-b9fa-1f26a8a5a0ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457308, "uuid": "d35bfd47-82bc-4bbd-ab82-c0bf50fb5f74", "value": "dlr.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21d9c819-958e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786457311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457311, "uuid": "cc878a34-7e95-4802-8004-14440768baf0", "comment": "Malware payload (Mirai)", "value": "25edff839a104f497fb750ef58cf616c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457311, "uuid": "2f0788f4-0248-4b6f-9a05-1538d0e154b1", "comment": "Malware payload (Mirai)", "value": "8338c7927e798188599cad921943f7b0d5277b058f0521bcca04f5e8b7414b25", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457311, "uuid": "697f4056-6733-4ba8-a0f3-81633bb8a683", "comment": "Malware payload (Mirai)", "value": "956c6c64f1d4d13fb95723b849ae2a8af856a379", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457311, "uuid": "f90edbee-4356-41ff-b016-0f9c8791a137", "comment": "Malware payload (Mirai)", "value": "dcde1ff904eaa4c015d6da0eeddc3951c52350e02b118950d79d57c6aa02546380c132fabcb578456dd5a42c73fe4a70", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457311, "uuid": "f1e1c80d-0464-4c00-b74d-4f580883ae17", "value": "T112944B42E7D3C8F1D85305B1446BAB3A5A369C269037DF57EB962E37AC21741872A33C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457311, "uuid": "d2685603-3fef-4393-aa1d-f8e756cc67f0", "value": "6144:FF0njc3t8MoYZ/4cdb7RKCLTCNXo9CA3wJZQzY+01tUP+xtPuEEB+J3YrcaEy8D1:FF0jKrdRlHaXubzY+01mmxZU43gk6YW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786457311, "uuid": "b707f00c-a168-4e34-81b6-d8aaefd0678c", "value": 411624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786457311, "uuid": "3dbbdbff-326d-4296-b941-3f81049d2bc9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457311, "uuid": "09338330-4e17-4e63-883b-ead41be8eebf", "value": "sys64.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ebbd5f0-958b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786456017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456017, "uuid": "38ca0ae0-6778-4618-ae47-51f90ac5b250", "comment": "Malware payload", "value": "c2adf2214c639e9ea4c6d8d042ebb08d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456017, "uuid": "75ab8ef2-419d-4971-b56c-e20f8380b853", "comment": "Malware payload", "value": "838ee86c214de6eeb35970370aee4117f423efe956af9b8b8a992c73551bbd0d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456017, "uuid": "b85e0a79-94f7-44f8-a782-2dea823e033e", "comment": "Malware payload", "value": "d9c68548982917cef0476e3da9ec8d58fdce1ad6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456017, "uuid": "2543848d-48ce-45ee-b9a3-e77438eb0262", "comment": "Malware payload", "value": "9c44e33c4c8644ede068351ac639ea0cbb724a500365bb87279ee02bbafa687f6d5481ee5455ee08d9f60eefcf00987f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786456017, "uuid": "d34ce634-3160-4735-87f3-15987bf8682e", "value": "T1356384567303996FF8B907704BF28AF4A3D878E635B06696E72ABF4C0F310996D085C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786456017, "uuid": "a6661ba6-1d0a-47b9-931e-a40a6adbd0dd", "value": "1536:5zhZ73Xm3PXD6VwfXUzt70Fx/NoGv1YB4ou93jpkzbTTbftKQCCJ5qGgvLK5eKJx:5zhlnm304jNeTbnQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786456017, "uuid": "1715a9bd-88e1-42b4-ac25-3d8aeb363f68", "value": 68136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786456017, "uuid": "35b5b56a-ec77-408e-9b52-6806343aca69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786456017, "uuid": "2744f248-2a45-4d2e-86e1-bc8e065bc9df", "value": "main.mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f3c02f8-9572-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786445468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445468, "uuid": "ee9d1a9c-e343-4b97-ad75-669fb284e30a", "comment": "Malware payload (Mirai)", "value": "5758daed63a81d4cd97022000ac58e0f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445468, "uuid": "12073650-1d6a-4d89-b7b1-6335534eadb8", "comment": "Malware payload (Mirai)", "value": "839bb3c86603faa0a64b4ff57cbe1155c313e48be2350ab240918869e6c476ca", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445468, "uuid": "a12fdef0-eb48-4874-ac3a-6dfe1df7e04f", "comment": "Malware payload (Mirai)", "value": "149bd52d69bc91e054d1bdbf05ae7fbcd2e29cda", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445468, "uuid": "e136dbfb-aee0-4dc1-9c7f-2d85ee79f4bc", "comment": "Malware payload (Mirai)", "value": "485e742b2147b6594dccbcabb597887f7a7e4fcf5217b9263c870dca339ed7dc35d12d41d1923193b31be742d169f18e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445468, "uuid": "9c4b71af-eba4-4452-a345-e06f1f346d4d", "value": "T1F7833A91B982566EC6D023BFFA5E538D337663E8D2DE7213D9118B1133CA51F0A73A90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445468, "uuid": "f35b366b-73ef-4c57-a5ac-261ce89692a7", "value": "1536:fPVymTpsjsTDaIRVY/MSzT1w7Fncvi0SApMkaWmPSGIydZSL:X4kps46IRVY/MStQKPJaxI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786445468, "uuid": "e5e7a3ca-0ed9-4b11-b96a-c0125090e458", "value": 83344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786445468, "uuid": "cd2e07dc-e663-4c77-b271-fa9727f3c140", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445468, "uuid": "7fcc31c7-2e5d-4448-a0d1-52d6750bbc80", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ce2fde6-9522-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786411078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786411078, "uuid": "4f64ff45-66ca-462f-a8ef-33766d2ed54b", "comment": "Malware payload (Mirai)", "value": "511f7933f550b9cca45e7698a838a605", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786411078, "uuid": "78794fbe-ae57-4a0b-b9c5-bc8cd79a206a", "comment": "Malware payload (Mirai)", "value": "83a7f3594007039ce3df172e73bca5fbba86b7486f27349841d5df9fee6f4b07", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786411078, "uuid": "e621d274-1eed-46bc-8bb4-241e0ba84360", "comment": "Malware payload (Mirai)", "value": "4e822fbe444d5b590b3c86ad49ad2968bc941255", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786411078, "uuid": "1d1dcc94-5bc1-4de4-a54d-fbc734383c31", "comment": "Malware payload (Mirai)", "value": "36fe0690f1d802c85fab1ce5313c9b9fbceda5874a268070beda8d8f5012e1c17523ab6da513389120c43c487177b0a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786411078, "uuid": "233f85a4-3343-4af9-8677-8e0046f0c176", "value": "T1F34301766BAAD6BDE535C6701B14C268FF18AD0A97441F53CD0D323A8BFE9903304B26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786411078, "uuid": "86d24887-1490-477d-b490-ca508ba3b11f", "value": "768:pmOLLOv3FK2McKSWtA1uVhMxx88d4xIUbEkNoH/A+ZhuIcK8xr2O75wjT:5LLOv3FK2Mdo3bdyr/NoH/A+Pw2O7U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786411078, "uuid": "28df7dfa-4aa0-45a2-b2ab-55f126efc59d", "value": 60468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786411078, "uuid": "8c400ac7-a916-4d73-b531-01ad2ba34c2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786411078, "uuid": "f1b10749-c09a-4c6d-baf0-f2a216e68f5e", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "642055e4-958d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786456992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456992, "uuid": "4d0d9313-1838-4502-a52c-dc7424ffa9e7", "comment": "Malware payload (Mirai)", "value": "d79ab12e99a4206b413d1bdeda34f4fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456992, "uuid": "d1a7ff1b-2cb8-4cac-8746-3f587bef287c", "comment": "Malware payload (Mirai)", "value": "83d7d7021b78f957cc6198f67da15c89cf95045c018a7d3390ad43d97be0af0e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456992, "uuid": "61262e73-70ca-4075-ad1f-06814b687cbf", "comment": "Malware payload (Mirai)", "value": "28b9491abc6d4ff2502c668a13517c5be784522e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456992, "uuid": "c9fcef40-1f54-46d2-87fb-8ba761b207d8", "comment": "Malware payload (Mirai)", "value": "cc86b73f3b910a6752650b61679a127c73b9a0c1680d6ece384a2346dc9a97eac00693fbc2f4c807a21ad96c5c5751e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786456992, "uuid": "8229bd88-69c2-4d5b-b441-427a86b6cbcc", "value": "T161D39EA8DA0F6D42D2D7F3BEAD5A0FA3313378B44215C2B60D00515DE9EAED88CE1527", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786456992, "uuid": "683e2369-ce27-43dc-b7e1-44cd48a01689", "value": "3072:9jI0ItBpHHoHL9jiWN4es0tZL9iDLOx6qz4joYKhRWb:98DPFu0WWes0PL9iOxHQxKa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786456992, "uuid": "b8ee8eb1-3ddd-4755-83aa-91a52cfde96d", "value": 132976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786456992, "uuid": "6d79d97d-c176-4be5-8d43-f687c0a4bb89", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786456992, "uuid": "08390d78-3b36-4c6d-a3b7-b6caa3ba6bef", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "392054ee-9557-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786433727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786433727, "uuid": "7f528e28-a178-43f2-9458-84595fdcb8fb", "comment": "Malware payload (Mirai)", "value": "0976c39150429df828f52977a13a7fc4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786433727, "uuid": "f3d788e3-27b3-451a-898e-1bced32286b5", "comment": "Malware payload (Mirai)", "value": "83dc485b2b943f3b54ee758f646281d522b7a9ab6778950ae95943dc2eb09e18", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786433727, "uuid": "fa686af1-aeb2-4ea9-a779-0de375355181", "comment": "Malware payload (Mirai)", "value": "b0fcaf38994889d3d54fd4d58fa8de5a725f91a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786433727, "uuid": "a2ea0dca-5c7f-4dde-868c-822fb5873f5a", "comment": "Malware payload (Mirai)", "value": "862bf7f57a7f32464093d07f980134b924605020d3606d7ab57ee7228be1d914d04958c547d7946cc0e5e04b94217c00", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786433727, "uuid": "cdb266e0-bd59-4e1b-b718-bbd654993639", "value": "T1ED844B93F2A228FDD952C930825D6613E638744943116AFB27C8EB753E16ED06F3EB50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786433727, "uuid": "24ae2552-95c5-4913-bb82-06947181b92f", "value": "6144:asVgO0noWgeBqzN+dE3kXMVbosrSFVsWlWtT2uOtRtd0oNi8LOvCavrE7SehwU/P:auNcoHVkhcVssenvWSRPNLOvCHGkoVS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786433727, "uuid": "2e10f10d-b208-470b-951f-5df522d8174f", "value": 398048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786433727, "uuid": "29ea8991-45d2-4fb0-8280-dafe3ecfa55d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786433727, "uuid": "b590557f-bf94-4a65-bae5-7ebcfd9fd455", "value": "data_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72cbc5f9-9589-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786455299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786455299, "uuid": "74c09b13-ae1e-43da-bc7c-32ca6f10258f", "comment": "Malware payload", "value": "8c96db8db739ae162f813bc289738cd9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786455299, "uuid": "e29feb71-e190-4d6d-96b5-e02dabb986f8", "comment": "Malware payload", "value": "846a7065e95ababdbc5240f5bc76524e9c8929fc88c75b22cffbdb9b457a0d60", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786455299, "uuid": "05733187-a97e-4bb2-8dca-edcb1750be4b", "comment": "Malware payload", "value": "05b74abda19c361fcb4ba6723f3b878c63307902", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786455299, "uuid": "0443e27e-a24f-4c5d-92ec-0c8171a24aa2", "comment": "Malware payload", "value": "74d3f536739b814ce0965e03b3153d6736c4f8f2078a5f0321eebd557eda42cd94f6974002f43018386f9360b437bcd8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786455299, "uuid": "32ceb533-471b-4584-a9df-b03fcd348177", "value": "T1EA63542A2A21EFFEE16E827047F39E70975525E236E1C280F26CD7485F7028D185F7A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786455299, "uuid": "29b9121f-9d78-4ee5-b7b8-3f94849ecb2e", "value": "1536:7jqbY5JBn1YYiQStNpgvNb48+ShzTv+z2gOzO2L/UY:zu6P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786455299, "uuid": "a3b87f36-4a27-461c-8ac6-c9afb11af767", "value": 68480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786455299, "uuid": "20c01cdf-7d49-4179-b40f-0df8d242773b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786455299, "uuid": "a8302d81-a61b-4c28-8a29-89e42cbb7e38", "value": "main.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17736f9a-958e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786457293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457293, "uuid": "50882850-342a-4393-a47a-133f53e3d4d6", "comment": "Malware payload (Mirai)", "value": "e507b41a363c6f9fecbfda6b272031bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457293, "uuid": "c782dce4-ba9f-480f-a1f9-6abdbcc88e89", "comment": "Malware payload (Mirai)", "value": "84fc61c65cb8f559575883fcab6431e82745bc8e7551a540fa6f3134a56efc77", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457293, "uuid": "0adaa67a-d2bb-4ed6-99d4-bcc3ab496192", "comment": "Malware payload (Mirai)", "value": "168162f040b8648e5cdf77c7243846179273ec7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457293, "uuid": "c3c33b2d-043b-422f-ae54-b131846726cb", "comment": "Malware payload (Mirai)", "value": "2b50c69be10ccd469b46f29aed84f98eec6ee084a490e9611f0e8961b2dd3557dacd5ed1f1329d996228fb2391a660fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457293, "uuid": "ade42ff1-9932-4aba-b860-bdf843ca535d", "value": "T194E44A26FC819B91D5C15BBFFF5E925933132B78E2EE7103DD141B2427DA89A0E3A601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457293, "uuid": "e475dfba-ff6e-45f3-a7d6-9db03899500b", "value": "12288:mMTJMMw9rcArInr/SgcCAwPmlyzAaS3DsZXzPvzar/S2QJx8CeVThlrKM:hcUr/HO6AaAQZnzau", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786457293, "uuid": "adc22b78-e823-4f42-bb38-78900afbd965", "value": 682008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786457293, "uuid": "2a06577d-bd53-4ee7-add3-57e168d03e19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457293, "uuid": "c855c83f-a0b9-45d0-b594-098c8ef33780", "value": "sys64.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cd3992e-952f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786416473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786416473, "uuid": "faf36194-7c4f-4e18-b0d1-46b9893cb3cd", "comment": "Malware payload (Mirai)", "value": "6c0347ef3bb3ceb7057c0fdbdf1f3103", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786416473, "uuid": "8e1fc003-1a57-4de9-bc98-dd2d982c49f0", "comment": "Malware payload (Mirai)", "value": "8504bcf762cdb0c3f50b12764c0fc2e1f9ec44532e1ab1113b41312c4c5c41a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786416473, "uuid": "25ef2b38-c5f8-465b-a8cd-2af04533b04d", "comment": "Malware payload (Mirai)", "value": "bdfe789557bd9889c975c12cf9e92a99c539e3af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786416473, "uuid": "5d104410-0125-4a95-91a3-41025abddb0f", "comment": "Malware payload (Mirai)", "value": "12bbed96b380c12b3d2b1df0f7de8434633da6da8c756872b5c088dee2a98239bde317c42bf790d1426a6d92c977d584", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786416473, "uuid": "a1668e95-3c67-45e3-a74d-7f5a78ee4b3d", "value": "T1D313FB42FA5A8707C6C272F7F75D428D373A6FA8A3FA3221DD316FD063826D51526122", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786416473, "uuid": "714c8551-910e-4c41-ad53-600ea9c09985", "value": "768:q5/MN66EkRRaYzO7MCDddPNUQTTn32/DaFNwGKZJvOeDKlhXg0a:2ABK7PDdVyQTTXFnKZJO5Q0a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786416473, "uuid": "5432147e-7c42-4d57-bc1e-ebabc22735f5", "value": 44484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786416473, "uuid": "4d18756b-5f32-4200-9594-82f6e74b56b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786416473, "uuid": "e08e741a-36f3-4f16-856f-91a1ce157e8d", "value": "main.armv4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "038331c6-956a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786441798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441798, "uuid": "600e9974-30f7-4480-a835-c3f68e0ffdbc", "comment": "Malware payload (Mirai)", "value": "63bc744a775bd8edfb70143a6eec6bd2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441798, "uuid": "2b7559bc-67ee-405c-8d58-94af87c452db", "comment": "Malware payload (Mirai)", "value": "85090ccd14760a984d72148e5f7542b9857352daba3c3f32c33c4a4cd0ee62f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441798, "uuid": "c89a0445-cea6-4d27-bd07-701d69d0e2dd", "comment": "Malware payload (Mirai)", "value": "6da96c4c6a355e485536fc00361e7f4f1ce54412", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441798, "uuid": "3721647d-cd1f-4bee-84c7-8d68ee7862e6", "comment": "Malware payload (Mirai)", "value": "d95de8218687e6ef4da84c8c50f23cf6420b9f9da92c9635bbfc4bb7725a53dc34d64318b8e3557ede10f3efa9dae4e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441798, "uuid": "3df52c31-bbb3-401d-9bc9-f064a2ef74e0", "value": "T1322302B53512A4F6F800D0B2C39217265A132BB72447EC4ADD65F786DCA3274AA93BDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441798, "uuid": "615ddf42-0737-4ade-864c-b4c60451512d", "value": "768:o79Ni5hSfAkdEc30/rVb73n/DSkzcWXpuhLjsJJVbDeJQSogZHUvwZd1CacAVJgz:8qfIEck/97PekRs/W/6oY0K1fVJu1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786441798, "uuid": "f2fa4e3c-b00a-41c2-bcc3-93fd921f4f7c", "value": 46644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786441798, "uuid": "95eea112-203a-4068-9189-84a0cdfdc2e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441798, "uuid": "a84aa35d-718e-4dd1-8e19-463fcd5f44f6", "value": "Mystic.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af809533-958b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786456260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456260, "uuid": "9506c50d-cda5-45a4-95cc-4c78b06bf100", "comment": "Malware payload", "value": "270d16dbab5c653b1ab57e166b8090c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456260, "uuid": "2388f9df-49e0-49ca-b3d9-82b5d472d38a", "comment": "Malware payload", "value": "851d568b320fc7e5b967daffa3fcfb538919b01821a9fe5f1863cc93412428c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456260, "uuid": "9a03f305-fd21-48f2-9261-30d6e7b74a84", "comment": "Malware payload", "value": "4e19e1227fd952535cf63152f766048e9700a9cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456260, "uuid": "b5550095-52e2-46d6-bd34-a79f571690ea", "comment": "Malware payload", "value": "0e6d4ddf0eb73abf5604a319a335eb962939e6e926bb64cc1540b8952cd857cb39bccb5e9cd34ddbf89dde665877a7b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786456260, "uuid": "3f242c5c-b8af-43c5-a162-c67cab3babe6", "value": "T198D33B51EF0C6C2AC9712AB595F727A4B79078D12134CA3137053B2F19B7236AC8BF99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786456260, "uuid": "65c3ca95-398c-40c9-808e-01f83975411d", "value": "3072:dDL3xe+8j1XZuFrBw4nN6tELUMuv8G6LovqlpCFP50:dDL+UrlMiLRuvV68i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786456260, "uuid": "50c5a94a-76fb-4790-bfb2-88e791c28386", "value": 132248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786456260, "uuid": "58dbfd3e-a79d-4b24-bc82-373677b25114", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786456260, "uuid": "34d78d04-07ce-4a19-b17e-70988ee236fa", "value": "main.power8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bc85ebb-958e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786457300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457300, "uuid": "aa2c4ef5-4409-4642-a456-969a9e2cf4e7", "comment": "Malware payload", "value": "5c93adcc7c22bf2d81d43d8e2da92a82", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457300, "uuid": "674c0d22-7769-45e8-ab30-afe49648bbd0", "comment": "Malware payload", "value": "8539a1810c5f00af5bb3829b6ad6f654d7d29cb232f8d50bb16042c7217990f1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457300, "uuid": "082f6c92-6e88-4b1f-a56a-7ea68283b2b9", "comment": "Malware payload", "value": "04d6e6550d6214ec9c558be492048b048e801c5a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457300, "uuid": "b9ecf8e0-1774-4f06-abf2-af20cbad3c5e", "comment": "Malware payload", "value": "e8a330698a1d6a51dea9824da1d035b62d3d01daafc6f0a19cdb9fed8e748b41c8ef3804b1b5f1f6fc6d308490fc32a6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457300, "uuid": "b2cc38ab-2933-48a9-96db-064eed7e5186", "value": "T136412DC910458A392CF2DA6E71E58898F3E1A0B720D59FC694FB34B7404DE581D82EAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457300, "uuid": "c9b71e64-482b-47fb-86fe-bfe940de7afd", "value": "48:v0dj40sM9F0hdhj00hvA0CGh01rm0Ygz0c8x0v5k0DVe0SWB0gYl03v35aE:v0dj40sM9F0rN00hvA0CGh01rm0Ygz0A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786457300, "uuid": "648cdf04-690d-494d-ab78-ac2d4aa88637", "value": 2347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786457300, "uuid": "c143d002-3e31-404f-ba64-90d720cfb62a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457300, "uuid": "6a497078-51d5-4459-9676-c988ffb0d30b", "value": "aws", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42765940-95d0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786485712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786485712, "uuid": "02e028ef-6ca4-417f-8361-53cb7bffad88", "comment": "Malware payload (Vidar)", "value": "b61a45e62218bd9fc761dfeebae61f8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786485712, "uuid": "7654d788-0990-436f-86d3-ca2b69d5fcad", "comment": "Malware payload (Vidar)", "value": "856795ad3b9f699534f06deadac42c036698b7d2f0d79689bc80af5eb2fbfeca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786485712, "uuid": "aad11cdc-6312-4f60-ab50-15028054ec70", "comment": "Malware payload (Vidar)", "value": "2a1440e3a0c3058e529916ec6b8c855bc9b6aaa4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786485712, "uuid": "7aeb40ab-a642-4af4-99a2-a63edae36a04", "comment": "Malware payload (Vidar)", "value": "df41a6f400d7bb839781aabbbdfa412d224583b4e6ba4ed960f558e35d60bc5c2db3e0d6c013cb9bd08f0e2646c0bbb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786485712, "uuid": "f3e6a99b-62a8-4aad-b8f1-c0e1633d7cf0", "value": "T1C7666C43FF515EB8C095EB34897A42427A64BC6D87383BB72E21ADB03F2A3D15935B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786485712, "uuid": "9f000797-e67a-4889-b611-cbce1e73840a", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786485712, "uuid": "e034e1e1-0925-40c6-bd78-e5420901b31d", "value": "49152:9uUMo59jzIgkMdbyfemjC6l4R/B5NvRstgi9nIPHQUCAlCKhzzX2w+Gjj+Wd/d:9I+yffjC6lmi9nUQ+1zzv/d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786485712, "uuid": "a29f5e6e-821e-4498-a97c-e16fed798186", "value": 7028288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786485712, "uuid": "29099307-ce79-464c-b3c4-dae963c952e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786485712, "uuid": "a686ff07-3d82-46a8-9dd3-e3cb707d6b0c", "value": "856795ad3b9f699534f06deadac42c036698b7d2f0d79689bc80af5eb2fbfeca.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3740f7ba-958e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786457347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457347, "uuid": "e44412b4-517b-456f-953d-88b3712623a8", "comment": "Malware payload (Mirai)", "value": "72f67d50c40729840c5aef3d26b52660", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457347, "uuid": "8bb9dd88-858c-4e51-8a94-4fd75863e71e", "comment": "Malware payload (Mirai)", "value": "85d13abbc39ecf5651d7912e955a85b6586624d6646864d74f260c878ad91b2d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457347, "uuid": "6921d55a-e77c-44f3-989e-aca9adea2314", "comment": "Malware payload (Mirai)", "value": "6570b8cf1ab4c9a8360eac60e5f074e37da9ad33", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457347, "uuid": "8bf17865-670b-4588-bd58-324fa3c97360", "comment": "Malware payload (Mirai)", "value": "d875fb8f4953b8385381b89118953b1a8ed3622328d2972763ab897d8abd5170dae33455ea972697b96921448722dea7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457347, "uuid": "2be58390-42a7-4e17-bd4c-d978e00d81f9", "value": "T1FA941965F8819B92C6C02BBBFF5E834C331767A8D2EE7103CD156B2537E689A0E36541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457347, "uuid": "4647b31c-5cbf-48a3-8ff7-64fc84f57d28", "value": "12288:s+CiXXLVZqd3DGX2e9zcxcHo3gxw5qDImljnXK:z4o2kcxcHo3gxwYB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786457347, "uuid": "929b4565-148a-47fe-8fb3-da5727269975", "value": 448680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786457347, "uuid": "a7a4d088-eb4c-4eb4-91cb-62dce6bc18c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457347, "uuid": "ba2cd389-7f60-4922-a42f-dd7137f05b1c", "value": "sys64.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e396794e-95bc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786477392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477392, "uuid": "4a9623d0-b83d-438c-945e-05da85143777", "comment": "Malware payload", "value": "4b70e93e18aba9e20624c9c9a857102a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477392, "uuid": "748fe29f-a44a-4714-81e7-a478e35752b9", "comment": "Malware payload", "value": "86471dd821e25ab210520b3f852d9016f03f5be9cae8f53f924b0a678bdc20ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477392, "uuid": "cc69f4b4-a7d5-4098-bab0-d07ec38a30da", "comment": "Malware payload", "value": "9fe6153dfe99da38db7fbf88650281f2a4911388", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477392, "uuid": "c0a4976b-9c69-46ba-8860-9f6659eeeed7", "comment": "Malware payload", "value": "cf369c3ec3af3a1eaab5ae20e2f9e8ced0390620b147a60ebea1454f86a8209977de0858cd20064b58c213edf2cf4251", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786477392, "uuid": "72233133-ef57-4ec4-b2b9-21a8f4d15020", "value": "T1DA366B03EEA548F9D296D73588774242B764BC499B3533D32E60BA742F363D0AE79B40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786477392, "uuid": "9bf57c23-062a-48ce-a8b6-d870a2f90229", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786477392, "uuid": "13e7806a-a468-4626-a1e2-82483cb3191d", "value": "49152:uFKpz7i7FAlc03DCBGcm+a1h6TczyJPj4RRHrYvAaa7:uc3XND1aJrCOk7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786477392, "uuid": "ed1ec37e-c2e9-4511-9fd9-5542c2fcfcfd", "value": 5003651, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786477392, "uuid": "de48397d-5d9d-465a-b7cb-99e97e6b65bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786477392, "uuid": "fdbbb4eb-1c35-40e5-944b-a25b45ad406e", "value": "86471dd821e25ab210520b3f852d9016f03f5be9cae8f53f924b0a678bdc20ee.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f176ea05-95ca-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786483429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786483429, "uuid": "bbe2a3b8-3564-43e7-ab76-75ed1b7038dc", "comment": "Malware payload", "value": "4917acd99fdbd30a0a00a0355706b83a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786483429, "uuid": "64325fea-61cc-46bd-9451-4ccd413307f4", "comment": "Malware payload", "value": "86925a897548ef79113c93dfa240427d22f2aae78047fdd91dbbb23a086790f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786483429, "uuid": "be078c4c-7cd4-4c5a-aa8c-f2045d8b1d11", "comment": "Malware payload", "value": "2e5efcf209e78990ac474ecfa85445379a5169a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786483429, "uuid": "4bd317b6-6c52-46c4-aab5-26bb74bbe506", "comment": "Malware payload", "value": "3e3973e92e3045dab2e8a2d5dac7ac8e90febbfb356bd43e5f114ad989fb2f254823f7e1a5a7dfed7071f11c012f53b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786483429, "uuid": "c38e2854-03d2-44bf-9549-facaff714b7d", "value": "T1F413F946FA519B05C6D232BAFB8E414E37136F68E7ED32319D306FE013826E71A39525", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786483429, "uuid": "9774d93d-8f3d-4b78-8756-277bac84b2e2", "value": "768:jRnTC4tXIvB//PfFpJUNUB3D0mEwVjZCY1kirY9fDltnOaVfJIz:jRn1lIvB/X/JzB3VDVjjkirYlDltdIz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786483429, "uuid": "6122111b-b51a-446b-8872-5979c87ca836", "value": 45152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786483429, "uuid": "87f9d8a2-6e5c-4044-aad1-36f4a9a7084d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786483429, "uuid": "d8dc004c-fdcd-43d8-89f8-d8d8607f9435", "value": "main.armv5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab01d02c-95dd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786491471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786491471, "uuid": "be603e3b-235a-429e-be84-12208488d32a", "comment": "Malware payload", "value": "30aa8e1df5c56ab59cd2edd08ea19591", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786491471, "uuid": "d05da851-1199-400f-97e3-b930afaae3de", "comment": "Malware payload", "value": "869ab46ec7bb45806a50a6c10b7e5b2e5a2461b6bfd775703564371f4b404f3d", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786491471, "uuid": "e106cf50-24ad-492b-856b-b64a6b8c956f", "comment": "Malware payload", "value": "7025db6b61e0e2d291a5b2271adc8ba3f81d122f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786491471, "uuid": "6a8de5bd-da4b-43b2-9ebb-72615cd5dd25", "comment": "Malware payload", "value": "d7f9f28965d05176b6601d31f984a063122613aa2fbf28f3a43cbaf96fa3ab31211ac1d65fa53ca1ff3739a0236fda8d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786491471, "uuid": "1226e9e2-e9bf-4512-934a-6f97d829bdfa", "value": "T1E647337EA4A6165FFD0A623345A6EA6CA403FFF01D688C4FF8324B164D8A4B05779D34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786491471, "uuid": "3d3da9c3-7f78-4b48-a4a8-bddf080f8e84", "value": "786432:lw/mQeMO19EHSREdzptCsVwDpm6rsGqZwl7lZvD:lw/B94+zvCsMIGqZ+5F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786491471, "uuid": "fcb39028-06c8-4cfd-97dd-25b6479b5eb3", "value": 26910326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786491471, "uuid": "7a330c39-f8ae-4bab-aede-e355c64e471a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786491471, "uuid": "5091a431-40a3-4c3d-927f-4d4bb797da3c", "value": "fdProxy.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cd8f20c-9572-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786445464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445464, "uuid": "e3c05da5-9d52-4da0-89c0-54ca464ee421", "comment": "Malware payload (Mirai)", "value": "34b3f2a4a1b92c33496c92dc7b661844", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445464, "uuid": "7cfd28a4-3c20-49dc-986a-19dc9896e7c9", "comment": "Malware payload (Mirai)", "value": "873df9f9b60344695b19bcdc2d8f6a110a9ea91450002e0b459b2a70eb56356e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445464, "uuid": "df6c6ff7-dac9-4c88-872c-215173f3dc26", "comment": "Malware payload (Mirai)", "value": "bc8f97ba800410b913b7016077c5169340c980a2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445464, "uuid": "2569c3ac-c448-430c-a61b-ce4064af00a0", "comment": "Malware payload (Mirai)", "value": "8711c10d25b2b2f1e79d5fa6c9ed29a3a94f049842dc49145770a071f5a41ff4dd68d49399c818d39079fedb2e25c2ab", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445464, "uuid": "7ab746c6-fa3f-47b3-a970-546e6e311f69", "value": "T13534C61F6E228F6EF269CB7447F74D35975823D726E1D681D2ACC2101E6028E641FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445464, "uuid": "1e92a494-ca10-4f33-9c11-713bdb851196", "value": "3072:kLwttum4bo68zKUN4Vk3qs4wuYyFeXODZIlVgZ56:kLwtEts6KqrbHFHDZ8Y56", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786445464, "uuid": "81f2fc6c-bcc4-4e29-9c88-51838869f86c", "value": 240260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786445464, "uuid": "63ce222c-0adc-4242-b36e-e24c42d156e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445464, "uuid": "41b2cc37-4463-4352-896a-b4b079a26b2c", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a0f8d4a-9523-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786411422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786411422, "uuid": "bd58b6ce-ee8e-49dc-9ee3-4c48b69d5ef2", "comment": "Malware payload", "value": "b37711f09108899c1245036205db7988", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786411422, "uuid": "d3cd7e5d-2ed1-4420-9f8f-c1558ca3bd89", "comment": "Malware payload", "value": "8760d69e7776681bcb3712d3e13bdee42f43e6566a395424cb014876bc3d1863", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786411422, "uuid": "070af6b5-cb4e-49b3-9db6-3ac6406926c8", "comment": "Malware payload", "value": "272ee3f1ed64124e76aeba289c6779c5d57064aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786411422, "uuid": "df8a91f4-477e-4ccb-a2f9-9f178a5c1c67", "comment": "Malware payload", "value": "5a4d2720e78dcfbbd03c2041f2b8eca3be18770a07440f36976fea1aa61b2011b90cf3e4881aa1530ab25c2f70807ccf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786411422, "uuid": "b3446787-da53-4f13-9ef3-fe99688a69c9", "value": "T13B13C647632E0A87C0772EF03A7727E0876ABDA112E49540565EFFC54235EF06192FAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786411422, "uuid": "3d337865-0f3a-480f-8d0a-6fb2f773ab53", "value": "768:G4v6DRPI4wkVPDH98VBuH2BAONseADYeejZ5555555555555555T55555555555t:DqBdqw2BFAD1eZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786411422, "uuid": "f78572c8-cbb8-4645-8913-535b35832d08", "value": 44584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786411422, "uuid": "db59a0a7-eee5-4f97-89fa-f90f62f50aae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786411422, "uuid": "ed870c59-c105-4019-a5ce-a9b49524f600", "value": "main.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "923aaf14-9550-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786430870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786430870, "uuid": "85d3957f-9fd8-4a7f-b673-8b397474a3de", "comment": "Malware payload (Vidar)", "value": "14ca810daf0e2f39f91430a926ba057e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786430870, "uuid": "50c50b3d-3282-47a1-a7cb-0a2ad3399682", "comment": "Malware payload (Vidar)", "value": "87a171e6a749340ffe3699524826cb1e52cad6e8f0e2350e84ced50dc13a8de8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786430870, "uuid": "4b3d57f4-bc63-4390-9782-d085ba32782d", "comment": "Malware payload (Vidar)", "value": "fb23cc15f29de6e9f3398d0430451c995c695d36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786430870, "uuid": "4777a9ca-3866-4ca9-9357-7f7174823b83", "comment": "Malware payload (Vidar)", "value": "b2c59f27a2ff8fe1f8d9fdb1054e694301748effbdf670c8784a27acdbd1609632846f0153e44c35f5190dacfafd56e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786430870, "uuid": "d03dd837-3fa1-4718-8906-f8a2d38080ab", "value": "T1006422C56224219FD99128B0CB0245937E9C75837CBAD6A2A3DFE2C4E9DC7C93E0152F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786430870, "uuid": "4b284090-1dea-4bab-ab18-3651fe75f801", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786430870, "uuid": "024a1113-8a59-405b-b48a-4cc5962c8300", "value": "6144:b/nyRFP6OUs9LNkewS6D1zqfD4DSXG8PF56XmljojWq1OZNwp+0:b8FiOxFcDcr4V8PF7lsjEbwp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786430870, "uuid": "d194126d-409c-4244-b256-25600dbcff3c", "value": 311808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786430870, "uuid": "1454d665-8aa0-484b-b6d4-125e808dbbc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786430870, "uuid": "55b2ba94-299e-4e97-818a-ab013a05fd51", "value": "14ca810daf0e2f39f91430a926ba057e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a81c55ab-955c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786436061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436061, "uuid": "cdc367fa-3f74-4b2e-9573-8f1f203b3f60", "comment": "Malware payload", "value": "6cdb46cc206d3af4577c002835efd9bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436061, "uuid": "69c49dfc-216f-4f2f-beb3-97b3c58055a4", "comment": "Malware payload", "value": "884a577414c62915e7eba5cadad6b2536780de2e933f38040d825e597f2f9db7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436061, "uuid": "78c2fea5-6288-4da7-99d1-cf72b77e6115", "comment": "Malware payload", "value": "cbd283664299a2f638500b668f6000f58eb3bd1b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436061, "uuid": "c6d45bb8-933a-4cd2-bb4f-873e5ecfe50a", "comment": "Malware payload", "value": "79bc421cc28b7d2fa66d2f0a28782412f29d22d6081d7358521584c9c6430f3e498cad5f592351590a25fb79c8445b50", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436061, "uuid": "8a4aee20-d965-4a5d-bc06-56080f9124cc", "value": "T1AD660761BF88EE1FE69821359AE6C23473D53D0081E074368B16F7191EBF2689D1BDD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436061, "uuid": "b8fe0d7c-fce0-4f79-abee-b24832105226", "value": "24576:HrOnVUh95LhoYfDonChMSxvVi6ab9ypbzH/0BNZMmecZ2ofMCaasZSGCzfEI+Sim:LlB90n2vViBhM/0PZlTSLTA49HH4t5EC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786436061, "uuid": "2515dceb-d719-41fa-9b54-2ddc58f04543", "value": 6488226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786436061, "uuid": "3b6d9b06-2643-4d25-b247-bfc5d731a561", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436061, "uuid": "bc97f956-fbdd-4b0e-82df-0240426b55a3", "value": "bot.mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59cb4482-95c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (WSHRAT)", "timestamp": 1786479309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786479309, "uuid": "1d897868-8c11-42f5-b4e0-879eb2a4a1e9", "comment": "Malware payload (WSHRAT)", "value": "9a3ce3ede01447cf89daec941700698f", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786479309, "uuid": "06d258d3-e049-4308-a855-2463febe775f", "comment": "Malware payload (WSHRAT)", "value": "886298aa99068d65ed1643de260cb5352f824a363dd745837a0d3fa15c57e1d5", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786479309, "uuid": "b08f19de-4615-4d00-a6e8-1311092757cd", "comment": "Malware payload (WSHRAT)", "value": "ed84db27dd97857fab4930572239b611333a8283", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786479309, "uuid": "9c37ca56-ad31-4541-822e-1f3021006d6a", "comment": "Malware payload (WSHRAT)", "value": "54cce94dd8d0ec8eed90e78ee8302c620d61c4338abd76fad72a6f4d63797ad6ec496500df50120021917349b9a21f7b", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786479309, "uuid": "ea8ea146-06b9-4e30-af23-16954987a4f9", "value": "T14FB54B4036FCF6797F690B1E62F7DC4F42D060866959241A5206F93F6E6F2920ECF4A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786479309, "uuid": "850c57f3-94d9-4732-9a3d-b6ca02177163", "value": "24576:hLW0BbSqDiuFJBLscWUKzc/ow7FkzIHY0oOB534ZYjEzdjY1EN7yCNBvImtoR:5Z2gKtc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786479309, "uuid": "3391cf48-37f4-44fc-a544-ae68a3dff438", "value": 2449134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786479309, "uuid": "5b042f33-78a5-41ea-b7a4-4cdc8a7b3e46", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786479309, "uuid": "1e4a4bdf-3056-4378-a293-ef7df8d0778a", "value": "PurchaseOrder026811907865.PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e150e83-958a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786455774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786455774, "uuid": "f45d174b-0045-4cc1-a599-05f77808fac7", "comment": "Malware payload", "value": "a4ed4e5622267e3aab6a30f58a00a4aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786455774, "uuid": "9ff75b8f-a3db-4026-88cc-a895440c3236", "comment": "Malware payload", "value": "886366eb7ee5a0b0bc2ddac16e0b96dfcb8608c87c7b54ac61f46599d836356d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786455774, "uuid": "ef26a25e-130f-413a-af9b-8f89648354ca", "comment": "Malware payload", "value": "cd7765be21078a6000be93e388a86b9985639a0a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786455774, "uuid": "4e45ad30-8bc5-49aa-93e7-ad4b9933d907", "comment": "Malware payload", "value": "248c47c463e3afc8a7ce21a2a4514e8a8fc23defd337017a08ba52c7a0fc5ec344289e7685a290d439d9d080cf0d465c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786455774, "uuid": "0fd42733-a5a5-4f64-a16e-b9dcc5ec3c32", "value": "T16343D649FA41AB05D59231FAFB8E414E33176FA8E7F93121D9305FA023C6ADB0B76521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786455774, "uuid": "44aac2ea-e861-476f-acdd-5eb25b00b409", "value": "1536:jtn8DrK2I+G71MhtIhyUAf9EPmlqy/bi/hxoRFTu:27ZG71MhtIhyU45uhxo3Tu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786455774, "uuid": "f6bf53f2-fb20-4f48-a671-0bb49f77f470", "value": 58528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786455774, "uuid": "2e5919fe-42da-46df-947a-bb24d8f6a43f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786455774, "uuid": "795d0cfc-728b-44f5-ad25-572d46617d8d", "value": "main.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06f4236b-95dd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786491196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786491196, "uuid": "5e67d7af-70cc-41b2-94f2-c61257f254fa", "comment": "Malware payload", "value": "b7d80493dd1fc36b249bdd69d1a5377e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786491196, "uuid": "5c8697da-039c-48ef-bdf9-63c450879cf5", "comment": "Malware payload", "value": "8900203d200a6bb3d5c40a24e2aabe688c1ae28ac2620234cdb1b1fe4bab0559", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786491196, "uuid": "379bd50d-afdf-46de-a90b-113c541accdf", "comment": "Malware payload", "value": "85aff4273d01fa3f95d8ad3869077fad14dd5b14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786491196, "uuid": "c57885fa-30ef-4f83-bd4f-bbf3664b521c", "comment": "Malware payload", "value": "2c8a8641d6a873038c51daca6d5bf14286b4d00b51661b24a789dcadd3ea72802ec2119add6dae60e3bc58fa81f739d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786491196, "uuid": "13a11faa-d4a1-4b0f-b793-c3df3909f35e", "value": "T1AC266B43BD9149FAC0D6A33188A75256BB71BC0C1B3523D32E60BBB82E767D15E72B14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786491196, "uuid": "95fcfbf6-302f-4ab4-8b60-e30ab6c1dafc", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786491196, "uuid": "1c39aff6-6132-4f10-b494-e9d5005a084e", "value": "49152:lLGIRkIHvZT+NzvJ3DxUSQ/ixXLb/GDsV90Uc5g:lD6NrBZxX3+D09", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786491196, "uuid": "b0a23641-333f-4d86-9883-d1b1f280c7c0", "value": 4524392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786491196, "uuid": "c80a516c-918b-439d-807e-62550ca57d90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786491196, "uuid": "28fce782-791f-442b-bdc5-fbfb232d0d10", "value": "8900203d200a6bb3d5c40a24e2aabe688c1ae28ac2620234cdb1b1fe4bab0559.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b16c541-95d0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786485700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786485700, "uuid": "65a8d397-44c4-49b2-ae5c-adbc80c5960e", "comment": "Malware payload (Vidar)", "value": "fab8a840eb6150891c7d0aeb91c5d36b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786485700, "uuid": "b8f43d2c-c0dc-4e85-b5ee-bd203e4d2f76", "comment": "Malware payload (Vidar)", "value": "89570e511508e037fb79e2382704a3c07f9552f1b9a1e50c7722cf22fa477e48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786485700, "uuid": "b5452f4f-7551-4772-a14d-25ae33529b43", "comment": "Malware payload (Vidar)", "value": "95b7625959f75da571a2c841c67480dea54e8266", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786485700, "uuid": "7afa5508-f191-49e9-9e76-3224b8f45d7c", "comment": "Malware payload (Vidar)", "value": "b42c67473c0f566c32b6eda6bea4bc108cd9f2cd89e0f66dd7c92745d8b3f16766b2095179983990185e0c336748c985", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786485700, "uuid": "979eb6ec-7854-4ed3-8fae-98fa473f443c", "value": "T192265A03BDA108F9C19AE73188AB42527B74BC4D4B3133E32E50AA782F767D15E75B94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786485700, "uuid": "00808329-1099-4041-b86e-51fd022043df", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786485700, "uuid": "1bb350b3-c166-4ded-983a-0d4346a15fa8", "value": "49152:mWIgc4vJdz94vbC7ZGHDyG9KH2SAVBVRHHMdHAKuorEg6Dc5d:mombCsjycBVhMd/uyR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786485700, "uuid": "f604a66c-3e6c-4819-802a-959201bc425f", "value": 4595056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786485700, "uuid": "7cb1d36e-2a6a-4a84-925f-1de31cce097d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786485700, "uuid": "689453f4-9818-42da-a759-27cafadd6a86", "value": "89570e511508e037fb79e2382704a3c07f9552f1b9a1e50c7722cf22fa477e48.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1975f303-9580-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786451284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786451284, "uuid": "87bf7942-0f82-4f2c-9a24-ef871bc61eeb", "comment": "Malware payload", "value": "4370e5864522121d0338b05e21b9a461", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786451284, "uuid": "12565bd8-6c07-463e-8554-0c62e1c288ba", "comment": "Malware payload", "value": "897b9ce6e1b361ee418d326e765e66c3440823c42f38881190f219776a4caa02", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786451284, "uuid": "91cb0eb7-79c1-44ac-bcc4-5e9ac5e6b9a1", "comment": "Malware payload", "value": "7e846d6814ee75683dc8741b4f98b387783343a4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786451284, "uuid": "6c8f370c-1a42-4fb2-af92-cdeead348191", "comment": "Malware payload", "value": "648f22a4256b3030c3bf4fb50cce11089e706c516f2c1d601f32bae8eda6437b66f0a9a01d10200b4996f4dc6f580f2d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786451284, "uuid": "a22164ce-8767-4ed6-a464-c3cbb6fb4825", "value": "T140C27D956A867C44BEC98A3E4CBD2B1D6DF5C3D1224952AC3D8B3C71DC11FACC618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786451284, "uuid": "57b2539d-f438-4eab-9dee-74cceddc9f11", "value": "768:OcN8vCB+25j6es8Rv9FYpMSUpi+20qUpi+20YQX:fN8l25J5d2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786451284, "uuid": "451fd445-3527-4a9b-a59c-241b8de56d82", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786451284, "uuid": "312790ed-6fab-4c0d-b933-81e9d34822c7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786451284, "uuid": "77990dcb-9776-42fe-9a8b-51b81f05f3d9", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3510cb6b-958e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786457343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457343, "uuid": "a078b973-76e5-42dd-bfa7-b5bbfaf35fd1", "comment": "Malware payload (Mirai)", "value": "db1551b31fc70afc212b8a25ea01f684", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457343, "uuid": "002627f4-4184-48e7-9a66-67212288ed44", "comment": "Malware payload (Mirai)", "value": "89ab7c1ae6dc1958d16133f4fd95caa9bcdbfbbdf785fdff7b79f45595d11522", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457343, "uuid": "0d4637f4-2b29-4fd9-87e0-271599ba7699", "comment": "Malware payload (Mirai)", "value": "597d6686f15a30e0db0aefa5aeb347c1998f11e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457343, "uuid": "1a6adab2-65be-4f0d-91c6-ec3913786209", "comment": "Malware payload (Mirai)", "value": "f4adbcd6b9fe6ae7c9fba683ec5f7f2e344742440aa483671726209fd93e0961064839df7fe4b7ca29f16bd9ee02f1bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457343, "uuid": "25545f68-0a06-48fe-aaa0-a641acccd5a8", "value": "T100B36BB3DC26AF98C615D074B0B48FB92F53A59482471FBE19B6C2B44443D8DF606BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457343, "uuid": "825245cc-68c5-4996-943d-d63b89f796a2", "value": "1536:WTW/VCxsHZaso2Li62C8HSKzRpv0PVmAlo2W8zDW+ztKVQ:WytCxcox62N1z+Vm12WsDb8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786457343, "uuid": "82c6b0dc-7437-4b36-9d88-69baff744afd", "value": 117568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786457343, "uuid": "60985c5e-9934-4eba-94e2-a75663bdef12", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457343, "uuid": "9e3b57f0-ddbf-406a-8b98-9c43f64f1c84", "value": "bot.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44bf2296-95d0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786485716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786485716, "uuid": "fe6fe56e-0faf-463e-8afc-067931895f7f", "comment": "Malware payload (Vidar)", "value": "9fb63f5a2c0321322e9c3721059a445e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786485716, "uuid": "b6f9fd6d-e88a-4665-8f60-cf0968f983e0", "comment": "Malware payload (Vidar)", "value": "8a2c70f0dcfb78bc50954ecf43103e1917b510668e1671d53999915042509fa3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786485716, "uuid": "1ede7be8-fcda-4546-8d6d-4111b9f58f1f", "comment": "Malware payload (Vidar)", "value": "539419005385590ad6203bb3294a35b01a51192b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786485716, "uuid": "f42c2885-5afb-4cd0-a858-2c0e6b55f264", "comment": "Malware payload (Vidar)", "value": "bd5fd1e9be0788fabdd5a934c87e2c6d24eebf6fdbfb7abf7d6160470aaf1972e93190f939a2c11bc3968e8e0d42eb66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786485716, "uuid": "b9fcd25a-c60c-4ddc-88a2-ee0c48e7e305", "value": "T10A863903DE905971D299DB38A47A9306A5A4F89D973433A72E717EB03F213F16E35B08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786485716, "uuid": "1707390c-561f-466e-9895-e8c8858699bc", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786485716, "uuid": "ece3a79e-93fe-4b31-8995-6366dbec3afd", "value": "98304:dnzUWOCldHwFal8t7/A93tFvRFi8a85eKb:dROodwF0c/KPZFUC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786485716, "uuid": "d110b6e7-9d29-420f-a5d8-ec80a3529d52", "value": 7927976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786485716, "uuid": "452d99dc-70a3-4abf-9021-52d293fbaf84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786485716, "uuid": "8d20904c-70ee-427e-ab77-83bb1d9739e0", "value": "8a2c70f0dcfb78bc50954ecf43103e1917b510668e1671d53999915042509fa3.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe7da961-95dd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786491611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786491611, "uuid": "ef0f7711-502e-475a-82ed-d6516ac37a9d", "comment": "Malware payload", "value": "4bbb71357e5848d8ea8908eebcfcd50a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786491611, "uuid": "1a1b0106-4a68-4dfe-8057-d2068062340d", "comment": "Malware payload", "value": "8a7a89769615229d0a96a5829d436e5ea1e8a279b513bcfcc61cbe3151eb5d37", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786491611, "uuid": "4567d446-8090-4cc3-bad6-5feb8cb6b0b0", "comment": "Malware payload", "value": "6d017bd5d672ccab30adefce6b59f702bd4688c1", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786491611, "uuid": "ab8ab2b9-984c-41e9-b754-ec3a128e44a5", "comment": "Malware payload", "value": "db622de56e33b75affcc25435a6c23b829f7f7ce61210372a3e75c4c9cd8a0391bf9ec83aac8e8ee17540e16a104e891", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786491611, "uuid": "a5f053bc-c6ca-4f99-919c-0ad65e9fdc1b", "value": "T173073360CC54222EE4818938650F9ABD17CBD92DCED8041FF3105FAFB98707A6F6969D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786491611, "uuid": "bd7baeaf-375c-4108-8b2c-4f2d0160745f", "value": "393216:UCSKxcOpj25w00Y5CHGLdPNYFfcLK3RhqaoNs2C+8x6MjR2mtiVYUAX:UOcEsR0OCKdyFULEhBisHuMjMmgu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786491611, "uuid": "24d9c7b9-ec7d-47a5-b859-0757b4a0335e", "value": 17590120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786491611, "uuid": "976541e4-c349-4372-93fd-440936782674", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786491611, "uuid": "45b618b4-7c3c-4d6d-b19c-91bb70c604fd", "value": "imapi2.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71d4c2fc-958e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1786457445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457445, "uuid": "7d825b11-bef8-46e9-a6d9-d2d7a026d7ae", "comment": "Malware payload (Stealc)", "value": "c14fc617180b21f4ac972a718b0f6347", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457445, "uuid": "a3876290-a22c-407f-bb54-856bd9e4b95c", "comment": "Malware payload (Stealc)", "value": "8a7e70710748b10cec4c9f0653c55a0439a7f5f8f51b1e60284ace75a2118c7b", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457445, "uuid": "e1801b85-f4c4-4ed4-ae33-2a5b7d09cff5", "comment": "Malware payload (Stealc)", "value": "4e0c2f52101595c696e3e58a8cf64651792f24ed", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457445, "uuid": "e928c939-bed4-416e-80ce-f414b5178a60", "comment": "Malware payload (Stealc)", "value": "b50865364d9b8b1fd111a134ce6db90134d6db082997b35afdaf4daf9e826cc64308ee46b93f7dd14ac709fa43efdab7", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457445, "uuid": "972ccaa0-36ba-4ccb-b53e-ad76a4ee61d1", "value": "T1E7167D13BAA54DF9D0EAD739886642127B35B849473133DB2E20BEF92F623D05E71784", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457445, "uuid": "93f05ba6-70f9-41b8-b442-059bdc54d2e4", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457445, "uuid": "a4ecf9ac-6e01-4c7b-93fe-4133986ab06c", "value": "49152:QriVPoBbCWcULcB+Z8XWwYyg3/0pRFE7Wxa9v/AyjFymQ:QCOsYy1pWWI9v/dJy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786457445, "uuid": "11966d61-20af-43d6-9452-7e2b4e1a6714", "value": 4134400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786457445, "uuid": "fb101c84-d2bd-4da3-8f0c-f74a40697fc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457445, "uuid": "704a592e-35aa-405f-a417-07fcb1f4ad6f", "value": "Licence_Loader.exe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee1700cf-959f-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1786464955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786464955, "uuid": "af965d0a-f5d0-4f5d-89b4-9301470bb04a", "comment": "Malware payload (ConnectWise)", "value": "e317344cb27eecf9283cb85a6519f762", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786464955, "uuid": "9625ac91-f059-4cee-874f-06814ae2df87", "comment": "Malware payload (ConnectWise)", "value": "8a976c6fe8aa93f3f1c97a6623873fb4214755d2fbfcbfac718f4946460483df", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786464955, "uuid": "f0c0a501-d0d8-486d-954b-4d233da5532b", "comment": "Malware payload (ConnectWise)", "value": "ad37d0d30c14f4b636183d110ceb9206b3c09f2a", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786464955, "uuid": "46a99078-4e81-4182-b40b-03b7c1ac5db7", "comment": "Malware payload (ConnectWise)", "value": "c31b913f15d67bfdea968266a83f5ad9028d61ee7c67e5e9c3450be2e478e7cc02dac8610d07f27c40e64443d893a6a3", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786464955, "uuid": "b2e8b2fc-8512-4adc-a93e-7a021822e032", "value": "T1DD46F141B3D695B5D0BF0638D8794266AA34BC109712C7EF57A4BD292D33BC08E327B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786464955, "uuid": "609901bb-c0bc-46e3-8788-cb2495f4f959", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786464955, "uuid": "d1361020-843e-4193-852d-2c24298346c7", "value": "49152:xfmLDKJkGYYpT0+TFiH7efP4yfy3Ys6vPHYs00Yrxl/jgq36+hKls/LG2XwygONw:irs6efPRy3BIvY44TnDTGvyEvgVxe7l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786464955, "uuid": "9e31a0cc-e898-4f75-bd0e-9578f191898f", "value": 5648400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786464955, "uuid": "c99a0faf-396c-4776-8471-8144c808659f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786464955, "uuid": "45eeea1d-b587-4414-b3df-c278c2b3e70e", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2e0b878-95ce-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786485149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786485149, "uuid": "982a68fe-1663-42f6-8cf4-939561bd3996", "comment": "Malware payload", "value": "12296310125898b354d35774f06b4700", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786485149, "uuid": "6fb15395-b805-418e-af62-bdf69f931f57", "comment": "Malware payload", "value": "8aca9284f5f4d237ac6d5d1573c29ae26697afc20e07dd6da430c3945afee8bb", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786485149, "uuid": "f4bb7c75-9011-4c07-96b6-f5d4c96d42bb", "comment": "Malware payload", "value": "4d97032781f367f64ff492d21cce11f19d4b339a", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786485149, "uuid": "c073163a-e122-4cd8-930b-c15cd7384643", "comment": "Malware payload", "value": "4d2224f918910068301cecb0821a0ff67a9b7fb8391b89e057d82ed2a65a57abf4c8f4b59c6c6ef809a93a1721071235", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786485149, "uuid": "bb2d4e36-9a28-4c3d-98d2-9169a896b88e", "value": "T182E6330866F1A42EEEB257349FE42A69D99CF8AF0774C1EF4A5C81941C573E04E780DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786485149, "uuid": "08d1c2e8-d4d6-4a1b-8d7b-91a205f7d5c5", "value": "976d2ad389e8b21847d44dfb70916b1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786485149, "uuid": "4a0b5a10-7ed2-4cb2-8cc6-b385d9c0ceb6", "value": "393216:CA7lEDLprJUVKyU9YY1AXMCHWUjgcuI3/PGTAI:CAlAJUVKhb2XMb81H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786485149, "uuid": "ce247b1e-950b-453e-85b0-1ef35f4c5864", "value": 13877860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786485149, "uuid": "c5a5bff3-814d-43ff-a20e-1c184766aedc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786485149, "uuid": "b8480a8f-0489-461e-a65b-7c9092d0bbc7", "value": "composer.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb211899-9569-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786441784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441784, "uuid": "c3f4ed3a-7d52-4713-a4b2-1c12c0753d31", "comment": "Malware payload (Mirai)", "value": "1f3ec5cae177195778403ce1b6868ecb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441784, "uuid": "e122f6a9-2432-4a20-99d8-ce93093c0299", "comment": "Malware payload (Mirai)", "value": "8accb95e3c9bfe40e1f924c6a4e8bb52ad10323fc8c0c1677c69667bd7e41f71", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441784, "uuid": "e363fd00-bf36-4015-bd91-8833af56ff1e", "comment": "Malware payload (Mirai)", "value": "de151b1054354bef2583ed788d6efcd78407a539", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441784, "uuid": "5e29609f-4f9d-4a77-a6f6-13c83209c288", "comment": "Malware payload (Mirai)", "value": "b09512265a8a3c7a1b242cb8d4625f40a176cd9b06d37c4bbcefb5c9fd3f073613dc6292b65ce5e68a46819eef557efe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441784, "uuid": "d35fe67c-a657-4e5e-9a16-37807a66c2a4", "value": "T1D9B34D8FF801DD7DF84FDABB54634D0AB920A3515A931B26635BFD93BC331A44906E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441784, "uuid": "1b2695cc-0bda-4624-b413-b8c379a7f3b8", "value": "3072:cFmac13YwZwBrY6ZDo724vp+uqMBa2hCAc:8U1rw0S4vYuk2hCAc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786441784, "uuid": "ee123e28-9631-43ce-94cd-8620188dec9a", "value": 116872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786441784, "uuid": "04b01dd3-ac73-4f0f-88c5-11b36eda3228", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441784, "uuid": "73eecaad-1090-47a0-a2f1-1080dd7db404", "value": "Mystic.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe8bd51b-9584-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786453386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786453386, "uuid": "efc9bbda-1574-401f-bfc6-1a48f089173d", "comment": "Malware payload", "value": "2853bf9260035cf1b0e4e0371f0d1cfa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786453386, "uuid": "0f8eb330-d305-46ac-b5f5-baba5101978b", "comment": "Malware payload", "value": "8adea4c745e94729d7ce39521538ea156f7bc3bfe7f4e64e498d9c202eb48ebe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786453386, "uuid": "930f7c0d-179d-496d-bd7a-c9f34d93f772", "comment": "Malware payload", "value": "524d4e5d909611b5a347b21362d6ae2627b01d34", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786453386, "uuid": "cec3b0fd-4595-4555-becd-68ab392964fe", "comment": "Malware payload", "value": "e780f8ec95e4136435bf562f1ffd252fad822d6460a889de096d9d17b42fefb24ff8d402df99274a83cb1dfb7890b89b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786453386, "uuid": "16b40a94-7ebe-4110-9e1e-5537d3b7699f", "value": "T1B0D32B05EF047AB7D09E8E7445BFC09204D63DF7A2D4833976D86A8DBE7C65906C3A88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786453386, "uuid": "36620df6-e7d6-4906-98de-4c6a2189fc2a", "value": "1536:n4m/5QK26tPnC6sIDYVM7d6bAwfJLXI5PGErb0O:Jyl6tPnCYpPucXb0O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786453386, "uuid": "628f57a6-156a-4ed8-b018-4c4a072d6975", "value": 140296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786453386, "uuid": "148eb615-6faf-49c2-a40d-2c4d78ac8cb7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786453386, "uuid": "be092221-7d86-4b5a-8b08-31caa550c9ed", "value": "main.mips64r6el-n32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1da45510-9591-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786458592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458592, "uuid": "666ccbb7-6efb-4f16-9d50-51bc04698186", "comment": "Malware payload (Mirai)", "value": "3c164771208a442154355368aee646f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458592, "uuid": "45407c22-ace8-4017-ae60-40756785316d", "comment": "Malware payload (Mirai)", "value": "8ae24e9ce37e13339cec90a0c4888fb54f51d50e7544c8f734308e1e3e08bba6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458592, "uuid": "fb65896f-096d-4db3-ab1f-1bf8f46f281e", "comment": "Malware payload (Mirai)", "value": "2a2a666afbe579d588b21b2bfe6266c78cc1efa8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458592, "uuid": "35dbf7da-db47-4132-b5e9-15aeb2aa2e2d", "comment": "Malware payload (Mirai)", "value": "85cda0e3dff43b9692ea690ec99c248f871a09026bf24f00bf2f1728724a4a33e4ad55f7ffdc4acfb338d8e1dba6fc46", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458592, "uuid": "b8d10e02-361c-4696-a4af-53ec848620ed", "value": "T1E8344B46EB414B03C4D627B9FA9F42453333D72897E773069928ABB03BC7B9A4F62505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458592, "uuid": "7a0a091a-de69-427f-b71f-a0c672e2428b", "value": "6144:qQ5s6TjLQ+mCZaFrP9wkeLkySmfxV/Gtr:x5s6TY+mCZaFrP9wkJS/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786458592, "uuid": "ddcd6b64-35ea-4a98-957d-b4b1169e6d69", "value": 239875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786458592, "uuid": "ea942625-2304-4a0b-955f-18c0a3ff4c28", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458592, "uuid": "9c082889-ad9f-463e-b7c0-bb990c8775d3", "value": "sdfjgnjsdf.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "554a8998-9591-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786458685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458685, "uuid": "0c0600a3-df27-4525-807e-f186ecc68039", "comment": "Malware payload (RemcosRAT)", "value": "39a07fb5a37b8c1696f41bc208f443dd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458685, "uuid": "e1a87508-7a56-4fed-815b-d9297209812b", "comment": "Malware payload (RemcosRAT)", "value": "8b0bb035d13376c7492a6a3c2c4b7897433a72b585331cad2b0f0eba0641ab18", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458685, "uuid": "c2c00d43-6241-43e5-a1e7-d4dc5adddb58", "comment": "Malware payload (RemcosRAT)", "value": "c018e0ae0c4017f4bff9c77f4736d6b8a27c3472", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458685, "uuid": "fcde0021-216f-428b-b377-ca147e61693a", "comment": "Malware payload (RemcosRAT)", "value": "5e69b3c3c540a87c329d193bdc3ebd965f6fb9b4cbade66cc44d79d8326c1c4907b50e894724fc244e239f7b8aec8f5e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458685, "uuid": "605a3194-c646-4d79-9ec3-40d067c1f096", "value": "T1F2355B6E433141BAE0DD21E81CC2A741A9D5E44B6CB5018D6F3834EBEE39A725CF746E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458685, "uuid": "0b31591e-6c1b-4104-b698-da7ee296387e", "value": "24576:zJ1N07vS8TVU8a81KHHR6caZx/s/YteyICXWLkZ1j:FaO+caZ3FmwN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786458685, "uuid": "25159c0a-7b7d-4168-b6e6-73240b9ddbcf", "value": 1155947, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786458685, "uuid": "60acac12-3f41-400c-a91a-43246095b0b7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458685, "uuid": "1e541984-5ee6-48a2-9d99-0dc70d3809c4", "value": "ScannedDocument_LX_BfyxdanP55dD.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73632a28-9594-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786460024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786460024, "uuid": "723ce753-f1fe-4336-b20c-f2c0f4e31ace", "comment": "Malware payload (Mirai)", "value": "1f90107fac630fdd79a09595d42a00da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786460024, "uuid": "f40d1006-80e1-4e58-981b-9958e0692f2f", "comment": "Malware payload (Mirai)", "value": "8b2cbc92f4a2a878304edd1560ba40a644e8fd55b46ef5d36f0cd0764d3c6e53", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786460024, "uuid": "d1257383-ff6a-483d-8e80-cb85a23e9314", "comment": "Malware payload (Mirai)", "value": "82da61e8ac511f49eb12f97fdac1160a5f8b679a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786460024, "uuid": "86185c73-c6b3-47d5-9d0e-fdbc6fd8fd45", "comment": "Malware payload (Mirai)", "value": "6b1c6aa5c096d040eb55017826bc4e224d8f091edfdab498d520a4152cebca4415024340a88374a97cc80ce1217b0f46", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786460024, "uuid": "8f65115f-8073-44a1-9833-6133814f8ceb", "value": "T19123F756F4D0DE62C6D47179FA9E119C33670B78D2DA3202CA207A3537FB56A4F3A902", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786460024, "uuid": "a60d9cab-edb5-41fc-aa1e-7bf39131171e", "value": "768:2OuANIF7G1Pwlhoky1fGQA5XI8QAPH73JIos0sObzabYZhB3SUAP3QnkeIxe:2NAJIk1GQAFI8QAIRO2YZhFSUAEe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786460024, "uuid": "b9b4adde-25e4-4839-b342-1b14f3a90323", "value": 46360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786460024, "uuid": "a055e1bb-4dc7-4c8f-949e-6c93744ffde1", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786460024, "uuid": "fdba435d-2574-483c-9a29-d371b05d881d", "value": "mini.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "babf89d2-957b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786449407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786449407, "uuid": "a856203e-a4cc-4d3e-84c4-06ba33040a4b", "comment": "Malware payload", "value": "a2988a6b4e32edc35f6e2c5e686f3124", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786449407, "uuid": "c8031f4a-d45a-42fb-9105-764a580ed232", "comment": "Malware payload", "value": "8b45f0f93f8c6a367bfcd7602e1a02ecfe886b5ed865c2a27cbc708ea1af5693", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786449407, "uuid": "b2c35212-40f6-4831-be4e-6a9283b87fe8", "comment": "Malware payload", "value": "4949d134003c90c07caf6cc9a6e22188254715c2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786449407, "uuid": "176ae51d-758e-49ad-80e6-c73d8c2dc0ea", "comment": "Malware payload", "value": "a374972430a62a797090adbaf78f86ecdc96a21fc1ad92fe401754286b24c9f5e7e1e7ec396e040be77f914194b72a63", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786449407, "uuid": "90486a61-5cfa-476a-8e86-6e04bc7efd5c", "value": "T1A1D0A75B8062A96259F5D6803A395509854025C703DA2D0DF5DCE6E06F88C4DB251B20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786449407, "uuid": "87988a27-ab40-4ea6-825e-136296e028f6", "value": "6:QOSB15fW8Y5copfW8Y5c8a2h2wRwCQmf0VO6hOWdGFfR:gVfA+sfA+5Q2kh0V5h5dk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786449407, "uuid": "143897f3-3a27-4265-a0aa-5db607fb2471", "value": 245, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786449407, "uuid": "9e10a35f-de0e-4ce1-8ebd-62b446791ef0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786449407, "uuid": "0db33147-984a-45d0-82cd-d17ffacd43df", "value": "traffaarch", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e2bfb87-9591-11f1-bd95-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1786458620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458620, "uuid": "374a760f-d98a-43bb-8dbc-957f3f0f1ef0", "comment": "Malware payload (MassLogger)", "value": "0dc364d514b74953c18d0c4ccf9bac3e", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458620, "uuid": "b72fc065-3dad-4906-93a3-2ba558fbfee9", "comment": "Malware payload (MassLogger)", "value": "8bb3f212c9684f4779848abf8837c368d45206d01930d65bae89ecc5b6589779", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458620, "uuid": "3ca07153-ba97-4bce-818c-46f85d8df5fe", "comment": "Malware payload (MassLogger)", "value": "8bbb7477751dc5666afee25b51aaca41f2a409aa", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458620, "uuid": "22f6815a-5602-493e-8a51-6d2a3b1048e3", "comment": "Malware payload (MassLogger)", "value": "1882a16fcb45923b3d5dcdcfea261f52792a82033b6ee4c3de45b87f2da260d77d97396d0dd38c662df85e9cd7d5eb92", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458620, "uuid": "6e205679-4a7a-43b2-b755-1e26c371fdef", "value": "T18543D2E41B2CC0D3ACD9FA54CC87DFD4A1787A273CE94E8A560056928B2D953FDA1DC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458620, "uuid": "f18ac190-4e41-4d29-beca-cdafc0b5049b", "value": "768:lVSlc3IAVlj7NgZpJDNg27ixFWwAWakMZqzdWiP4lOvJ2eibwFH7FWBc91Iz9JHZ:ich2hmLzssTM/9+mj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786458620, "uuid": "4325981c-5f9f-4822-97a2-34d352b5b0dd", "value": 56177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786458620, "uuid": "e2ca5cfa-93b5-4296-9177-8ddc563f66c4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458620, "uuid": "7e10aa23-3025-487e-8f57-8be1480c405b", "value": "e-dekont.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51eb0a76-958b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786456103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456103, "uuid": "6bd014da-55ab-4b20-86f5-fd27d2a44cec", "comment": "Malware payload (Vidar)", "value": "f643fc11b987d65ce3658fd2797ee6af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456103, "uuid": "94999f82-fc42-4ee5-8174-2eea0ccac698", "comment": "Malware payload (Vidar)", "value": "8d2f08e84e0a2d7683e23958006e9c60db73e78d71fd40b66ab0d3cab7ace0bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456103, "uuid": "c5d22899-6308-408e-96fa-c2f2010fe4e7", "comment": "Malware payload (Vidar)", "value": "1a81ebe81081f7b607945047ebf7891290f9c28b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456103, "uuid": "5f6b10ea-4761-4a8c-800e-cdc66fe805a7", "comment": "Malware payload (Vidar)", "value": "12531aec3e1cae1f7b9e94d1c4da78ebe271df9764377dacc189f2cc32f428f75ed0db311b299b61f57acb24fe54784c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786456103, "uuid": "0a4a0923-bad3-4fe3-aecb-f6f8be5b16d9", "value": "T1BC266B07AD9548FAC099E735C8B74252BBA0BC4D5B3133D32EA0AAB42F763D06D35B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786456103, "uuid": "ea252231-36b7-4711-bef8-d5148cf5d4fc", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786456103, "uuid": "cb322452-e92a-480d-9ce6-5c6976097eaa", "value": "49152:ICwSWNjFynVhjQfX9p4plkK5jlnwr/z7nlBzIswxDe0xhkQvFpgH0EBd9YntA/Ng:IdguH6sUjecpghP0Q6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786456103, "uuid": "657c45a9-5d5b-4939-a980-04589251bb19", "value": 4646256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786456103, "uuid": "40662adc-63c5-464e-b055-b8474a96d3e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786456103, "uuid": "dc58deb0-12fb-481f-ab5e-38751908f56d", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47660b23-952b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786414853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786414853, "uuid": "4d8b1434-4c2d-4657-b2a9-4f3836aac7dd", "comment": "Malware payload (Mirai)", "value": "222c8f344635099a50627866467cf347", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786414853, "uuid": "c82f8911-5dbe-494f-94b0-e2e934f487d2", "comment": "Malware payload (Mirai)", "value": "8daccce9ce083a42067a491adc429da788aa6cb7477607333b7bd36fc972ce90", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786414853, "uuid": "b6c4e8d4-4918-4d9f-87df-452433afc5cb", "comment": "Malware payload (Mirai)", "value": "f5fc729007d6d9ed39b1b8ddb37421e5f551c264", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786414853, "uuid": "6e710670-7837-46aa-bbd8-0f8588f082a2", "comment": "Malware payload (Mirai)", "value": "640a8a95f7c92c408d1f4cfeb252c9250173f70a82ed39b724e020a06b91e1b512821af9a523895b1c43189932698e46", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786414853, "uuid": "9904c717-6e6d-4ef2-b3c0-560c1d711c4c", "value": "T17DE42955F8809F61C6C529B6F65D42AC73074B79D3EB72068A254B343BEB86B0F3A701", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786414853, "uuid": "d82b3120-8bdb-4680-9a55-f0b5ed05b8b6", "value": "12288:nM0OAvgJn8Wei8nwmb4EEripGQ+tP+C/8J7kh34XBFhJ/55F88pqP8aA:MIe0i81LCiwQ+t2C0J4hIb/5a7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786414853, "uuid": "e7ae33e5-3cda-4a3b-9501-573c907fca9a", "value": 665876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786414853, "uuid": "765e1bdf-d264-4fa3-a857-d6aba7027c55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786414853, "uuid": "2cace828-a664-4eed-acea-9c04ae9f5a74", "value": "Mddos.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f49c11c1-9590-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786458523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458523, "uuid": "1ae5e2b1-7b08-43a6-83f6-242e8466935a", "comment": "Malware payload (Mirai)", "value": "848da9f53668b055dae1f0d4c4cad467", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458523, "uuid": "c2317fa9-c03f-48bb-b431-3e5d6bc603ab", "comment": "Malware payload (Mirai)", "value": "8e357ba516f8643b5265ed622e74f832e175cbf54e415fa0945f98c0eac6b104", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458523, "uuid": "88b1ab5d-a230-4fa8-9cff-df5b427b2b8b", "comment": "Malware payload (Mirai)", "value": "22cd865d66c96060f0e1fc9b8e46f1f31b86c415", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458523, "uuid": "2084cd56-8151-49e0-b347-3839a47f0880", "comment": "Malware payload (Mirai)", "value": "dbedd54a0dbb84f889feebb233aef0037aec168d686ec28ec7ded2b2692d2bd51d24baffc28b1f4d51bef072a5665883", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458523, "uuid": "b4edf47b-e642-4774-b03e-cd78e4044cec", "value": "T1576301DDF66EC2B8E9A6B1734249C1E8E49A3C3756010BEF0D85607B4CFAF4005A66D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458523, "uuid": "689f140d-3253-4880-9fad-37c885416092", "value": "1536:iRw8nigZCZBnzglmIBBDUdVH5mxNpq/WPftKS1QbjZGCVEspHLnK:4PiGqBzglRodVH5mZn30SKACVnpLK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786458523, "uuid": "406bd359-920f-4da6-ac15-abc167b8b966", "value": 69068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786458523, "uuid": "15d96020-10ed-4a4f-9bef-02cbed91807a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458523, "uuid": "6e71fba2-a226-4eac-953f-989ab7efabb4", "value": "sdfjgnjsdf.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "749dde22-953a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786421372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786421372, "uuid": "f7467520-6c02-4b0b-8515-fe1ee9c5627f", "comment": "Malware payload (Mirai)", "value": "d0ad5779034ad87a1f212bd0ad873a9b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786421372, "uuid": "e27c1275-18fc-4c8a-a16d-833c8f628aac", "comment": "Malware payload (Mirai)", "value": "8e60e279cfd707dabf7471aeebc97b54d9f6779bba7e9ad8f9f8b9e413259767", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786421372, "uuid": "47a98620-8a2a-4c46-af73-8160d9bc2ae6", "comment": "Malware payload (Mirai)", "value": "425963a90c67618aebfd2c263ecbd676d19510b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786421372, "uuid": "471f419f-3a66-4b4d-93fa-ea73f937e868", "comment": "Malware payload (Mirai)", "value": "38626e6ae57146665f153661ad721d629d22ae62f784aa577d4093f173c6d7421d7facdc7247bf6cf844e528f1fd0be3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786421372, "uuid": "531b207a-bc99-4b7a-9987-1c334efa642f", "value": "T1B5C34906756244FCC15AC474876FE927EA31785D03343EBF2784BA71AE22E365F0AB52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786421372, "uuid": "f7826b86-a817-409a-b84b-83e7ed92e858", "value": "3072:3lowqxb5Xehi9GCuA/ApDopPGbJSca5oTG4A2CW:3loV5XmMGtDopebfAoTO2r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786421372, "uuid": "e62983b6-9890-4385-9458-ed17501d6b02", "value": 128904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786421372, "uuid": "33418de0-b15f-4de6-a91a-bf56f9235b4f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786421372, "uuid": "780e24ff-84c8-46b8-a561-b262987601a5", "value": "putita.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ccd42b5-9579-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786448444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448444, "uuid": "ca873d88-a408-4c38-81c2-52a6c732ff5b", "comment": "Malware payload (Vidar)", "value": "a4afb5c6e806b55acd611d914aac00c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448444, "uuid": "d4d7dc83-406a-4fb3-bd2c-90966630bc2c", "comment": "Malware payload (Vidar)", "value": "8e6b1c20bf64b58a7a5a7043d7ef96d4baab228b071bd06a82e2265d181b43c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448444, "uuid": "f4f8c033-07dc-4115-a445-1f886a67131e", "comment": "Malware payload (Vidar)", "value": "86ae0561817d473512be22444a231fa9f7c463c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448444, "uuid": "23dcf61d-3cc3-412b-9b57-836fc21f1cba", "comment": "Malware payload (Vidar)", "value": "fbc7922532fc198fc5467d23951ee9668fd85e6bb85289dbad632592e0801d111caf09cea37b36de24c0f99f5551dcda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448444, "uuid": "9f0f961e-97db-415e-a6c0-f19fc676488e", "value": "T111069D47FDC108A6E469A23689B392523B7DBC09177363D32E90767A2FB37E09934345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448444, "uuid": "cdfbaaa2-a911-459c-b465-f3e4b38be21e", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448444, "uuid": "3f1563b0-c48f-420c-ad86-9bff3136cc94", "value": "49152:5FfDCvpoX/jAzCj1enpLyrlBg77KRnKn/inM/CYa92VB2:5oy8ejALu2qnKhLk4B2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786448444, "uuid": "38bd2efc-616d-40c4-ac36-3b632b6d2824", "value": 3779800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786448444, "uuid": "76c5a250-7da6-450f-a356-999dcae6756f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448444, "uuid": "442dcea4-abad-4a41-a88f-5bc39fad97f7", "value": "8e6b1c20bf64b58a7a5a7043d7ef96d4baab228b071bd06a82e2265d181b43c9.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b35ed913-956b-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786442522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442522, "uuid": "495dfd78-6aa1-4508-b3dc-b646e8588835", "comment": "Malware payload (AgentTesla)", "value": "8e09f437945601ebb29d8c76370c9f1c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442522, "uuid": "67243d2f-7e6c-4a71-a6f6-2184b9d85b94", "comment": "Malware payload (AgentTesla)", "value": "8e6c4413e352fa11f2c3790bec657f7b185171b438e57f915f73c15b937e1310", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442522, "uuid": "6551fd10-dc13-41ec-b486-34563a5be631", "comment": "Malware payload (AgentTesla)", "value": "925fe6e3cb51e664d61707056bf408acdf0170dc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442522, "uuid": "b7261ea0-d55c-4841-8281-36632c7fd70f", "comment": "Malware payload (AgentTesla)", "value": "ccacd99979daf1a035c0ea340b412e9c55bf7a2ed38fc73e8a751d70e669efcc597bacff409f5445edda833d7659a419", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786442522, "uuid": "5090e98a-bbf7-4c36-a939-31bbff086377", "value": "T134E5B5812784AD32B721AB9C923ADDF0990A610314C5DF16306CF2197B6DD1BA76CEF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786442522, "uuid": "c0f7786c-7930-4bbc-ab2d-97ea543ae1ea", "value": "49152:6KnClkQ9u/KsHtiDZWjMXpkVWMMHVmXcKlag3SddbVITiBK5qh1VddmHHvlMPkjY:9JQ9u/nHcWDWMM1Mag3SddbVSiB+qh1F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786442522, "uuid": "868d9049-d1f6-41f1-a6c4-86c4df5b874d", "value": 3052462, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786442522, "uuid": "1b05c786-ec62-4495-9c7b-04e1b75871f7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786442522, "uuid": "00dc7715-9cab-41d0-97ea-8c3ab4973c84", "value": "JUSTIFICANTE.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7642a734-9571-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786444997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786444997, "uuid": "43a5362b-d09d-4d4c-9353-5313a5e4e2b5", "comment": "Malware payload (Formbook)", "value": "a319602bcd4f0e4c09ad49c1784f213a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786444997, "uuid": "3fd2091e-897d-4d15-8eab-27d9b008582e", "comment": "Malware payload (Formbook)", "value": "8f40a33bd447833208c69a6d73c94752e19893da2788f9227422b1e15dcb6a4b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786444997, "uuid": "ea380e9a-0abd-4279-b9f1-39105d1ccf05", "comment": "Malware payload (Formbook)", "value": "5a5d100485d9f077fb59b62a818435a87b330d4d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786444997, "uuid": "2bbd9415-579b-4715-aad4-7d878b44a6d7", "comment": "Malware payload (Formbook)", "value": "f3faf0a1806984162013328030700535edb1cf12f1ff558416fd85a95ac91521a880d133b85d0ba31b34caba9673a6fe", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786444997, "uuid": "69907160-0103-4c87-9bd9-bf5064a2496c", "value": "T1117330485983B98493337F7FA22A5894F77A076700994D1B787CB490AFF1C09DEE18B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786444997, "uuid": "ad008137-01ca-46da-aafa-7eff9c2df39c", "value": "768:fXbbADfjoAkANbllfDhw5ErdLPH12WwKcKaRuGnRcVeKZNr6mhdB4reOwfKUvUFz:zkQA3dCrx1iNYR40JgE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786444997, "uuid": "dc44008c-2df3-4a2c-bea9-c0d63dc6fa4a", "value": 77372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786444997, "uuid": "d265b43a-832a-4c81-a9e4-fb556fbc543d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786444997, "uuid": "b917396a-f90f-4d9d-ac7c-a5fb71ff27a3", "value": "teklif talebi-boyahane-genel-kinetik.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc65a70b-95a8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786468737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786468737, "uuid": "747a124f-d930-45ed-b7ef-0dafd7536837", "comment": "Malware payload (Vidar)", "value": "604d34d49197cf794a3c52bbdd396693", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "windowsof-com", "colour": "#EEE832", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786468737, "uuid": "9a6040d8-8939-43b9-8951-010f33ff6f30", "comment": "Malware payload (Vidar)", "value": "8f5d1e9d077667f8fdde94bb00316a27e75314cf5f6d2930c65c386166007eb1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "windowsof-com", "colour": "#EEE832", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786468737, "uuid": "28f64547-890e-48ec-a4b1-a246572e0b24", "comment": "Malware payload (Vidar)", "value": "a98b933454c040970a3b0d5ed2f6b3e2998f1edf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "windowsof-com", "colour": "#EEE832", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786468737, "uuid": "901791af-b6a4-48e8-9d25-f9f70ac3599b", "comment": "Malware payload (Vidar)", "value": "79447174f67991fd9888bc04f336ea24fa0d17cc19e905adb383b84932c4c596bf50eaa05480d0a34467156ef9238664", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "windowsof-com", "colour": "#EEE832", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786468737, "uuid": "9c1e44b0-7508-45c3-8962-f1546132ab69", "value": "T146565C13AE6649F5C0999735C9B74216BA70B80D4B3133E31E52BE782F763C16E78B60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786468737, "uuid": "9052fe15-3bb6-4217-a413-da6e51b5c617", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786468737, "uuid": "caf81bb6-a536-4313-a000-da23dfe34484", "value": "49152:BIwatjg7O9MlxkM70XuZDnSq24Cj8SeTJNQ9oaITaKufVnevAttpB58DIKglbJAB:BoD+UiTJNYoVij8s51JxU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786468737, "uuid": "ffe66085-0fc4-4bdf-bf9a-2bd2d333239f", "value": 5963616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786468737, "uuid": "23042b32-e579-45a3-9ea3-e426687e74ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786468737, "uuid": "092e70b7-29ea-4296-9e0c-a7b2e3bb89e7", "value": "Download_Movie_Maker_2.6_For_Windows_7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adde3f42-958f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786457975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457975, "uuid": "d4cf17e5-5641-4fc6-b8c1-fef4900607b2", "comment": "Malware payload (Vidar)", "value": "067d10abdda4600d12f031f280c374be", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457975, "uuid": "4ced6509-5754-454d-9fe7-a6e74bfebb46", "comment": "Malware payload (Vidar)", "value": "8f7130878c8ddb276c5245f265e639320466e9db3f2061390255d523c39e4bb7", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457975, "uuid": "5f75ee2b-dadd-4ff3-8efa-0c95cbff037a", "comment": "Malware payload (Vidar)", "value": "7754394bee85316012c41dd898c9137372085c18", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457975, "uuid": "a39ef364-a667-4eef-b78c-c3e91f391f98", "comment": "Malware payload (Vidar)", "value": "e8db54ffe580573eec5e75fc7b145ba6a01c39a851c8174984f9ecd99827f9b0cfe2ea33a44265ae750a3c28d27353e9", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457975, "uuid": "e6e95031-1bd7-4829-92bd-d8400c337ec8", "value": "T19016AD036DA548F9C0A9A73A84772655BB34BC08473173EB2E21BEB62F713E09D35794", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457975, "uuid": "2e9d150c-b671-44f9-94b2-6ca3363edb61", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457975, "uuid": "41eeeb0a-2947-4ceb-9de4-5e20f73060a9", "value": "49152:NqV2snR8K/XNfTrF4bz6eon8NeF3TjYNtDaHrqir6:NZsrmRon8cFDMNpUrqim", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786457975, "uuid": "83405b47-7e9e-400b-9c87-be182c30001f", "value": 4163072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786457975, "uuid": "012ae39a-33cf-474e-96cb-b6c68e6f49fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457975, "uuid": "8066f5a1-edd4-422e-8d7a-5bbae746f143", "value": "Zeta_Launcher_v4.4.3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb544098-95bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786478694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786478694, "uuid": "6ca31266-9b6e-4c1f-a0b7-ff361f8db5ba", "comment": "Malware payload (Vidar)", "value": "6bffe20be81c52c59af9cdb3b4cf756f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786478694, "uuid": "72a35da1-24af-4f24-8d97-3a2a0bc174d0", "comment": "Malware payload (Vidar)", "value": "8fa05412680639d4bca0de808d4f174637f0cbbeb07bd311e4425184d3936057", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786478694, "uuid": "4fe1c748-1bb0-4ad3-9699-e55b126e7cd4", "comment": "Malware payload (Vidar)", "value": "4daf5ec9beead3f22886eec77e5175d81e6e8af1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786478694, "uuid": "b713494e-4e02-476c-b038-452206767e79", "comment": "Malware payload (Vidar)", "value": "271470592c4290f53c26a63cc1776cbe7effb3f137d495d32e00307b1c0e9ad5b5fa397ed4abe0a5fdb62986cd6081a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786478694, "uuid": "1c683a5b-739f-4ee0-817e-ccd2c1450a56", "value": "T14B764B2B9A524C74C09CD735887B421BB660B86D8331B3639E627EB8AF713C15E39747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786478694, "uuid": "0dc1fbc0-7405-4884-a74c-fa8fb05ea600", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786478694, "uuid": "ac9edd6c-81f7-407b-a1c8-863611719b92", "value": "49152:oXa2wrHsG5G2nmhCordV3KuiZzPy1kHRP05WkUkJ2WpkKvIwxA:oZRwpoeZO1Z7U1WLxA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786478694, "uuid": "ff42bbe8-bcbe-40ea-9bbb-169702982a98", "value": 7432616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786478694, "uuid": "0fef2f93-beb9-4432-9930-723024de42fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786478694, "uuid": "d1efc957-a2d1-4039-8021-3142dc4a082b", "value": "8fa05412680639d4bca0de808d4f174637f0cbbeb07bd311e4425184d3936057.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc8eb576-95c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786482051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786482051, "uuid": "fda146f9-3c33-4af9-a601-8073442a32ba", "comment": "Malware payload (Vidar)", "value": "de1bd5744b5dfb880462a04ee5e9fb3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786482051, "uuid": "fd166a5f-c591-4fbe-83fa-9153046e8985", "comment": "Malware payload (Vidar)", "value": "8fa9499257d83a30bf4737480259282aa928ce3af19a08dbed4b6eecfbb1f189", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786482051, "uuid": "d2711701-d713-43f5-a01b-ebc6ddc69442", "comment": "Malware payload (Vidar)", "value": "04774b0b774e7d58fad7b11a5e1bc66ae0ab94be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786482051, "uuid": "a5e5f8a9-a2b8-4fc6-aa84-ad4b045cad4b", "comment": "Malware payload (Vidar)", "value": "85ab275c19feb2c1088882442e88ebc2905a3b9c47099754142c4056f89155efe1bc07754024ee94582ba06569a6a9e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786482051, "uuid": "a2005473-6cc4-4c89-a3fe-41cffb7fc416", "value": "T132169D07BDA148F9C0DA93358927A666B670FC494B3133D71E607AB92F727D09E38B44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786482051, "uuid": "2e5d52d4-9744-4f75-85e0-1414a62f921a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786482051, "uuid": "a67c173a-f97b-49ed-83bd-0d15ad13d54c", "value": "49152:Iqpp9kSvGYM+2T5VIrKuleTqHMhAAoZ5jlZJg8nl4G1PKxITeXVENpj:IIYLCb5BZeCHVN5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786482051, "uuid": "7c2e7e21-7a6e-4759-8cfd-290f65dddd7b", "value": 4241256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786482051, "uuid": "8cac1ad2-87c9-46c3-97ca-13d6543a6927", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786482051, "uuid": "d5c995dd-5846-47f5-9e31-5b85da4fc2cc", "value": "8fa9499257d83a30bf4737480259282aa928ce3af19a08dbed4b6eecfbb1f189.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22602326-95bb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786476639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476639, "uuid": "04201d27-7c0c-42e7-8b94-2c3d8e411d1d", "comment": "Malware payload", "value": "2e8b41fa32a27b1d3d583cd5d01e17fa", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "unattributed", "colour": "#1869C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476639, "uuid": "87a362aa-ddf5-4b52-a00e-c421da586151", "comment": "Malware payload", "value": "9088ef663fe6dc4da3727efabe183c5cb22235190a988517755d04c9cc4b64e9", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "unattributed", "colour": "#1869C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476639, "uuid": "56058fd1-e4c7-41f8-97fb-f2575cd783ce", "comment": "Malware payload", "value": "09ef0ae87dc2df32badeba3aed3fb6d8235f7b2b", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "unattributed", "colour": "#1869C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476639, "uuid": "2a998b65-4a8d-474f-878a-63adfc0f5b8a", "comment": "Malware payload", "value": "566b85856548e5c789a90d415c8e9e93daf9dbc1f2080cfaba08f610ad52ce38bc8740b53803e3678126c8927ec91617", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "unattributed", "colour": "#1869C5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476639, "uuid": "fea8aaaf-f450-4255-a49b-eb529d8ddfed", "value": "T1C1B66B113B95C42AF9B6117C6D39AF48056DFE22177050DB938436AE0F32AE36A3935F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476639, "uuid": "ed755067-7b04-461d-8378-5e17a2fdecd7", "value": "2c0ee08cba66b618a5c40e0b93e5218e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476639, "uuid": "3738c5d8-56c4-4a5b-aab6-82683d3f031b", "value": "196608:J1Qyev6IOB+1vL2FsnbfaR9bKv1lOYggX:J1Qyev6IU+l2Fl9bKv1lOYgI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786476639, "uuid": "c6bd01d5-ffda-47f8-b379-cd20401c1c04", "value": 10646120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786476639, "uuid": "785bdccf-7a4e-4b97-a02a-7862269ff3fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476639, "uuid": "3fa11db6-5b7a-4191-8cfd-a315efc3c540", "value": "9088ef663fe6dc4da3727efabe183c5cb22235190a988517755d04c9cc4b64e9.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7da757cb-9598-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786461760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786461760, "uuid": "e8f76f34-73f5-4c65-926d-ab8a3d8289b7", "comment": "Malware payload (Mirai)", "value": "4546f53445d1f81543b5e70b83946949", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786461760, "uuid": "f9ec12c8-48c3-447b-bfa0-20c874dc462c", "comment": "Malware payload (Mirai)", "value": "90cb327bde61aab55d3d896767c847cb3361629812d6f07d1ae43b988a6fe689", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786461760, "uuid": "cfb8531f-3439-4488-8016-cb45af50f99e", "comment": "Malware payload (Mirai)", "value": "fc647d2bdadd3aa9d4a4bc1b3f604222e14de72d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786461760, "uuid": "55d69748-5dab-405e-942e-d6b72f185512", "comment": "Malware payload (Mirai)", "value": "6cc46d2f1aaa43bab44c7200039efdaecf09b2a262a297ac86316480ee5f54b49d640ea6e985b4a7d9f4109566f720a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786461760, "uuid": "0b7e004d-4927-48d1-8e53-3f8b4190cbc9", "value": "T181533B4B73218FD1C769DA3402F38A576BB626A227D39006F26CED512B6231D581FFE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786461760, "uuid": "c807df9b-284a-4e94-84ec-9f3b4c91ffff", "value": "1536:xduHBa8p5SCGJAZXNtXm2srmEuoslViGc7:xWBHpDZXL+KViGc7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786461760, "uuid": "6da01eac-9bce-4005-8fff-6d27a6467813", "value": 64728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786461760, "uuid": "7558df11-8b92-4cde-83be-7e164b4a86fe", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786461760, "uuid": "e7bc8161-66ba-4078-8760-489f6826a1b1", "value": "mini.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c78a52c-956a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786441920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441920, "uuid": "4c258216-5508-4390-a66b-57423904f4a8", "comment": "Malware payload (Mirai)", "value": "ff9d02ecc5ed0ae72d170c9fbd0bd3a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441920, "uuid": "0ab06bfb-c196-465c-94be-df1d82170ef0", "comment": "Malware payload (Mirai)", "value": "90cd8e0040778359659e42216f4582fec55dab3ac8821dbe713c655df908f03a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441920, "uuid": "c59b2606-6ff4-4328-906a-0ec98552397b", "comment": "Malware payload (Mirai)", "value": "f20588950b3eee577c237143ea2bdda0fcb74229", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441920, "uuid": "36a315a0-dfc1-4211-af6e-12c80305dc78", "comment": "Malware payload (Mirai)", "value": "4a39330feac637d7f246e404c5a8a9daea9f144992ae0e4271ab46b6f25709d2a66eb16b200516dec641cdf6b5f60b1b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441920, "uuid": "a30a5b1b-7561-4d86-bbc8-584b227b4a19", "value": "T15EA34CC5F683E8F9D95601742132FF37DE72E6BA1139CA43C7E85A32ACA2601D41A75C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441920, "uuid": "9857d971-4ce7-419f-a67e-887d046a3ffc", "value": "3072:vUr8lQ2Fis9Fif+3pxEH02Rm7OArS/PxJEH9PuAQ:9lQ2Fis9cf+3H202o7OAPpuAQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786441920, "uuid": "4bc131a1-72c2-4b07-9a9e-bb67c574da64", "value": 99892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786441920, "uuid": "62f407bc-2134-4229-a187-8a4d4c6a5fb1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441920, "uuid": "1645198e-45e0-466b-90be-72caa345c15d", "value": "Mystic.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b85f09a7-9523-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786411607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786411607, "uuid": "2994cc78-b6b4-4722-af25-3d04dec81c01", "comment": "Malware payload", "value": "74c2f0baf07761c05e98e04a7b8f77ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786411607, "uuid": "ca9fc660-0937-42d5-a97c-31035cc66162", "comment": "Malware payload", "value": "916162f62f9942458ed422ccb19d0d1edd302daa7522b1715812f35d2da6beb8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786411607, "uuid": "d8cd39cb-b15b-4b08-a658-980d1210a114", "comment": "Malware payload", "value": "d5090ba9a52cccc14d0ae155a1d86f33d90a660d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786411607, "uuid": "036c83e7-245e-4d35-abc4-aabfb1d03ee6", "comment": "Malware payload", "value": "c47c5649890cd2f74aa17c02a96c037d883aa5c8381d17ab11fa43b9614e5ab0800fef5dc2c2a6074d1099682500eed9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786411607, "uuid": "d01ba8bc-4b9d-4215-aae5-218cd8760034", "value": "T12453D71BB6A3B0BCC287C0745A9BD5B2B93178B002253D7FA7C8FA312D35D512659F62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786411607, "uuid": "35e85280-147c-4059-ab15-f7615fc77386", "value": "1536:BwVw3n8OAcFAuuyp7Kqz72wQXpvJCi5ARuFyW2MUr:6w0cFAcp7KqbSH4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786411607, "uuid": "1f0d04d6-d1ae-44da-b5b8-3f14a7f77952", "value": 66640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786411607, "uuid": "3b0efd1c-f396-42a4-ae96-419f9c08e40f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786411607, "uuid": "8478b1d8-04e6-4b15-9fe5-b745a8d51f93", "value": "main.x86-64-i7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd024fdd-9522-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786411239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786411239, "uuid": "f68ba083-e1a3-404f-9eea-d252b614dc08", "comment": "Malware payload", "value": "34cc51395d05dd6cd86e0feb5ed4a143", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786411239, "uuid": "13c563ee-d699-459b-b0eb-f76e3fec951f", "comment": "Malware payload", "value": "9198759b9ca91109f5a59dac8db5b8c2574fd32c29bd796e16a23ef595968e41", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786411239, "uuid": "7bdabf54-0b40-48b2-a3b2-813e467a5dcd", "comment": "Malware payload", "value": "9787924e18c396bdf7d9b22320e944284c92743f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786411239, "uuid": "bb8f5881-1444-4b90-a8d8-a1e3dd8657d6", "comment": "Malware payload", "value": "2abde90080f736267d8d789562b53d2990943421ca9fa641b8e7c9be05b454b838f33583a17fb60f34fe72304719fdc7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786411239, "uuid": "49bd4e0f-6843-4623-a8ba-fcb37db13f26", "value": "T18CD31957FF0C4057C48369781E3B07ADF320BE1150B99516230A6B6F3BB6E326687B99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786411239, "uuid": "ff46b373-2575-4716-a37e-7496341d3f0a", "value": "1536:qTdHGjrabJJ8hga/JO1g7wtGahEZwt2rFCl73eJ9NWgvRbw8r1i:qBHGjra3Ega/JpMtyZwt2raCvZkU1i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786411239, "uuid": "802eeb05-13c9-442d-9dfb-e6b8d6e171a9", "value": 132064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786411239, "uuid": "1116d3ce-5b31-479d-a917-c504287f1338", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786411239, "uuid": "6d7aa057-5b0f-43f9-83ca-2c000d3df0c1", "value": "main.e500mc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a506198d-95c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786482012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786482012, "uuid": "62f6de71-303f-42b2-ad26-479aa0d96e67", "comment": "Malware payload (Vidar)", "value": "60239d8977c758dcdbe5a3b5d886ccd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786482012, "uuid": "566aaaa7-40de-4fbc-8289-ade9ef3e9801", "comment": "Malware payload (Vidar)", "value": "91a2cc02adfca746b0ed66a0ad9b84ad77407b34c91ea2d16e2d97e6c4ebd32e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786482012, "uuid": "55df2ccf-e853-42bb-ae53-ab89bfe52f53", "comment": "Malware payload (Vidar)", "value": "46bdb7c61ec8257a6b19ca11db7a46c50feec94c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786482012, "uuid": "b8c6043f-a377-484d-88e2-74b985a14926", "comment": "Malware payload (Vidar)", "value": "869b1f01e3726b3f9776e563970ba9b1188142d95b0feec9dce4a4b29369052577e6e108637dcacf7765aeb56a3bb389", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786482012, "uuid": "fb79e17a-509d-4f34-a71e-f35d2597012c", "value": "T13E768D03F99545F9C0AAD2318667A232BB71B849173173DB2A90EB742F72BD05E3E714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786482012, "uuid": "f69a309c-fb3e-4ad9-a05a-595b3edd03a4", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786482012, "uuid": "d8442518-bdf8-4d3b-a684-a2e3714cf800", "value": "98304:025feLkuzyzdGvlKnHXnInTfnjT8hsF+bDC:06eYsyJyL7nbJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786482012, "uuid": "354bb535-2c37-41e9-9bc9-81ee29a41605", "value": 7808880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786482012, "uuid": "e51b7c2e-7425-47f4-a5eb-92ea1a51c40e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786482012, "uuid": "5bd8803d-820c-4529-9fee-0bf4e8583418", "value": "91a2cc02adfca746b0ed66a0ad9b84ad77407b34c91ea2d16e2d97e6c4ebd32e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8156adc-9528-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786413781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786413781, "uuid": "274b9f81-bd98-4879-acce-b8ab15cb63ad", "comment": "Malware payload", "value": "b63915b04854e6b3f2e7ee3f7873d95a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786413781, "uuid": "eafc42da-17d8-4731-b3f0-b3d930d000be", "comment": "Malware payload", "value": "91bc65200be32f5580e65b5ea5bb76d5943764784ac043cf33a36b6186d09e02", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786413781, "uuid": "7f5460da-6e51-4ffa-9ab2-400ee712abe2", "comment": "Malware payload", "value": "2c954944b8056e2058ea9d17694e56b8f7ce6103", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786413781, "uuid": "e9ff5671-7458-4ab1-be75-e4e30bfcf7fb", "comment": "Malware payload", "value": "5bcfa18ef0922f00db8b5180eb6c9eb819e06a8990ab7b46a918933004ef8e9d33f43f9c59a1ef5123689a7d674bba58", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786413781, "uuid": "0d577cd1-62e4-402b-a943-7a182b1b6775", "value": "T13343D649FA41AB05D5E231FEFB8E414E33176FA8E7F9312199305FA013C6ADA0B76521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786413781, "uuid": "2bfb3ab7-0e7a-4369-85a3-baa8908bd568", "value": "1536:jwnjYbl//mzoc7t4BCkAkdEPGlqyvbiTxzYEFg8KX:YYQzoc7t4BCkBpSxzYotKX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786413781, "uuid": "14ebb5d8-7425-4155-ab79-ae04e460e615", "value": 58348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786413781, "uuid": "0959bde9-e4ea-4b47-a68f-9127f03e5e84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786413781, "uuid": "237b1971-ec67-47da-a1ff-4384f712008c", "value": "main.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5a7a881-95bc-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786477369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477369, "uuid": "10d22602-e30f-447f-acd5-897436a23bc0", "comment": "Malware payload (Vidar)", "value": "d9dcd4ad90984f08caf6be50c925b0f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477369, "uuid": "425f8609-a362-4e56-977e-021dbff39405", "comment": "Malware payload (Vidar)", "value": "91fe20b9fc2736432d71548162babc44517dd083b0bc2a9abf7a7428a85c74c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477369, "uuid": "44035d92-0502-4bd8-8f0f-bf88d7755235", "comment": "Malware payload (Vidar)", "value": "aa604927556f9800128eded09b62b57de8ab0692", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477369, "uuid": "9da6dd0f-735e-4de2-97a6-1dfcdce8678c", "comment": "Malware payload (Vidar)", "value": "880e8aa5e6ed4183d9b5919df854f0ec1ea1168d5e7e4bcb282098d09f2852dd44ba7bbeaa8f944f7bb33b9c222223d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786477369, "uuid": "0c68aa13-b038-4104-9ca0-93b448d355d4", "value": "T138267B03BE9158F5C095E73589B74652BA74BC4C8B3133E32E60AAB82F763D06D78B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786477369, "uuid": "152a6c67-12a9-40a1-a418-927092c02fdf", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786477369, "uuid": "ee822d0d-3fba-4e22-b156-ef4d6932992b", "value": "49152:/PLavrCrG2cAUOemScByFvFguUmk98aUZTml391gVqYJvQMCPEdAUy5t:/OWemxGl9mlt1JYJvUEdG5t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786477369, "uuid": "8e898c58-c613-4879-ad52-3695aab67092", "value": 4721024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786477369, "uuid": "9778446b-9ff3-4b8c-b5b3-4a5519ae251b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786477369, "uuid": "4b0d9233-9792-4b03-bd19-548a1fb1d9a9", "value": "91fe20b9fc2736432d71548162babc44517dd083b0bc2a9abf7a7428a85c74c5.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3461712b-9591-11f1-bd95-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1786458630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458630, "uuid": "314623f7-1845-4622-a077-fc7b332abea1", "comment": "Malware payload (MassLogger)", "value": "45c444a8b674e128c23441cca04f52aa", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458630, "uuid": "fe9116ae-4b90-4dd7-abff-2df057af0724", "comment": "Malware payload (MassLogger)", "value": "92116dc2282959b83cb3132ff1b6ee77f9e4554cb3c899acc9faab92bf98ef85", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458630, "uuid": "049ac447-2f44-4f30-9310-b51b11b0eb98", "comment": "Malware payload (MassLogger)", "value": "80d1381ae72d2d9b2bc244ad1a645ada307bd751", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458630, "uuid": "3d1e6630-367b-40f4-9fac-4923a5d8c4a9", "comment": "Malware payload (MassLogger)", "value": "1ce526a38a38a24f2ac254c566a5329485514e9b651ef690dcbda8fbaff266056c23430476502d3c7df4e32972ec981d", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458630, "uuid": "a18d2f1e-8c82-486c-b60f-87ccc9a00776", "value": "T1A943D3B41B2CC0D3ACD9BA58C887DFD4E1787A273CE94D86565087928B1D993BCE1DC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458630, "uuid": "31ca33d4-2938-49ad-bccf-4070583aaf7c", "value": "768:E6crEYeuVTs+tuYeNWiWvlizZ6nXjVuf3GQHs9yw9YkOXqeW2zzGbbpgx8VOoHMZ:RWvlCwV/pZZhC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786458630, "uuid": "451db729-0a8a-4572-bf7e-9a8da263f236", "value": 56350, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786458630, "uuid": "08dc5e00-a418-4cc3-bfc2-2174cddffc92", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458630, "uuid": "4856641e-5af5-4832-a539-8459a39c30d4", "value": "tomanuce2334.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "073c4db7-959a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786462420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786462420, "uuid": "5b08b90c-3177-4cdb-adbd-9f8c198f3574", "comment": "Malware payload (Mirai)", "value": "577029d12bd869f362a9089b997e7998", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786462420, "uuid": "431ce252-d8a5-4e99-86ec-f1f8d77e1e2e", "comment": "Malware payload (Mirai)", "value": "927e3b0b1ac8e932ee2c860904b692b389a6bc0cd2d70b071fa565f0a47d1342", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786462420, "uuid": "bec01630-f901-483b-a13f-70af3ce2ff54", "comment": "Malware payload (Mirai)", "value": "d0095a9444ae08d44e388bc69fb1af27c4db452d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786462420, "uuid": "d308795e-fcd9-40c7-88e0-3e17e16904c7", "comment": "Malware payload (Mirai)", "value": "47dc90238dc747da95d9e04ac7017b535afb9ebbbe58bea7ae003a07735f7f96d48d88c08ed7667e3cbc02dde8abade3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786462420, "uuid": "f5bf1f9b-0049-41d0-bfb3-21ebaa31e856", "value": "T187F30C56F8818F15D5C1017EFE0D264E37232BE8E2CE72139D245B707B8A5AB0A3BE55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786462420, "uuid": "6ebb1142-5823-4203-bdcc-8180ec28cc36", "value": "3072:3VhOOV9C1uXaZRAxdch8QZRWUXtGalqsjbQYnA/PGf5aW1oFlRN:K8xdcm2XX4alLHQYz5aWOFlRN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786462420, "uuid": "0fc7d273-0299-4f4a-9a4c-9c544621d97b", "value": 170684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786462420, "uuid": "714cef59-31ba-4aba-9581-c0d993b819ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786462420, "uuid": "3dc082cd-d21b-4b27-8cf7-18ce7928dbc7", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe7d9f07-9597-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786461546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786461546, "uuid": "2685ae2b-4837-4614-be8e-5ff8f59157f2", "comment": "Malware payload", "value": "ff071520772aff54bd96cba1ff1e9a73", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786461546, "uuid": "791aa4fc-279e-46aa-a7c9-532bab9e3609", "comment": "Malware payload", "value": "92adeeb6460b2e21c20bc49747bdcff6fe25baffd35a9fbc09f86857cb94164d", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786461546, "uuid": "5f1ee177-4a51-42a9-8b6e-094e9800efe7", "comment": "Malware payload", "value": "b52ff08c25f9d03db6c4e1566cb441dee73c3f5c", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786461546, "uuid": "3c469b75-2c3a-4a2b-84d8-6fe7566d0b6c", "comment": "Malware payload", "value": "bc12675e86229c4ded78383238182cebe1b2f585a5d0ff37bdcbfd4b205d546cdfd43fb27c2d7654574ea14ea24a5b37", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786461546, "uuid": "103bf96f-cdf9-4b82-8780-c7df89201ee3", "value": "T12F440107470B697DE2329F33C28EED5A9F0E5B1F8C079EF442A18641994F3D19B6B429", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786461546, "uuid": "a91ebf50-e949-4c13-ba1f-135e39a508eb", "value": "3072:c0/ukQPnm1z8DwNU5sygOze8L2RbugyMgNurUuTUBH2JhML3wyY0WvtAlyQ9ckzy:8FPnmFIEPygMEbueWB2JuNYvti9ckzy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786461546, "uuid": "914e5f97-0d3b-4dca-ac6e-6ac9bfe6c93a", "value": 266859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786461546, "uuid": "4599adaf-32bc-49bb-89e2-986442ecdae3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786461546, "uuid": "42c358d4-ecde-43e4-b2b8-cb4a6696ef95", "value": "SecuriteInfo.com.Trojan.GenericKD.80930032.28228.16883", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f132370-9525-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786412316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786412316, "uuid": "f04b245f-3030-463b-8cfd-4bfa99679d8a", "comment": "Malware payload", "value": "2f452852d4d1be518f24b916e0efcd95", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786412316, "uuid": "04d94068-cba5-4f67-878e-10af6abc263c", "comment": "Malware payload", "value": "92f5d59c480c7158cb58d461c5ea8050994fdc8d3093095df6912ea696a9e511", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786412316, "uuid": "7fb75713-a25a-4f2a-b75c-9e004fca369a", "comment": "Malware payload", "value": "621e474ac82800e819323b5728dd7c55b0b0c3a9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786412316, "uuid": "0b9ab163-cb43-4e7d-861c-36c609cfedbb", "comment": "Malware payload", "value": "b707c4f266d57db914b15811de53b75c77ef48b4e56d2dfa36d538bbcdcc4771a38c914d72bc0ce40b33db035d0c22c0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786412316, "uuid": "f4921a0c-3bc0-407e-9e57-296de6d71ba2", "value": "T1ECC27D956A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786412316, "uuid": "461a2f0a-c1ba-451b-92dc-58455a4c33d7", "value": "768:r8vCB+25j6es8RP9FYpMSUpi+20qUpi+20YQX:r8l25JZd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786412316, "uuid": "661fd1fe-fec0-43cd-b513-dc5aa8ffd045", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786412316, "uuid": "aba351d4-e310-48a6-be23-aab151937c72", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786412316, "uuid": "61592ddb-1b56-4319-beea-83f2262042b9", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd3c95ee-957b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786449411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786449411, "uuid": "819ee1e8-5e0f-4238-b002-033271923f7b", "comment": "Malware payload", "value": "53162eca1d5d4a7b2c30773de1654aba", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786449411, "uuid": "854dbef5-2129-4cc0-98c2-61f154b159ed", "comment": "Malware payload", "value": "933d5963dfb7307e87a193e32681b9d1a4a23bd2d0821b091930e2a9460aaf91", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786449411, "uuid": "e903e262-809e-47cc-9f1f-3eba072c651a", "comment": "Malware payload", "value": "2ab1d2ce999d25c9d294492a999976780e8ea365", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786449411, "uuid": "737bf1d2-f437-495b-a59a-fd6b8a8494e3", "comment": "Malware payload", "value": "dd825d2bc25204a856c4773e9a298f1dc48e661a021bb5fd8f9516c5da08b53cb121df6210dbcb3deb6f56026f5d2dcb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786449411, "uuid": "e0cc1f31-df42-48a2-9cc3-f17508db17c1", "value": "T15A31D316B0825BF135C8C9147C6EEA94699524270395694CF01FBBF01FD8908D6FE772", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786449411, "uuid": "0eaaa64e-ab26-4064-bc3a-0cae043d8135", "value": "24:XYoifT6n2vKHUtKA37h8tuAS/pFfuAILYoofLM4eM2ykRZH/b3GYNzs3e+Nzqb:xifT6n2i0tTTv/nGXLOelRZfbjpelp4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786449411, "uuid": "57b5caef-10d0-4385-b08e-798055376e10", "value": 1560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786449411, "uuid": "658ee443-2915-4e9a-a171-c72b9ead6f86", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786449411, "uuid": "1169a8f9-e317-4d94-ad95-f33bcc0d9015", "value": "watcher-script-aarch", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bfade53-95d4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786487527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786487527, "uuid": "bf01fbfa-8d89-490a-9118-e7ef5b4eedc4", "comment": "Malware payload (Vidar)", "value": "eb18026ffd53e78377e613faf011a7b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786487527, "uuid": "4a4ae625-a4dc-4e49-b421-d8d0b3ed98e2", "comment": "Malware payload (Vidar)", "value": "93cf6b3cfc0e49213e384bbcf86d5930f96125b62e1940d7334642e40bf56e54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786487527, "uuid": "c76e46d5-d3d6-4fbf-bfb5-430dadc4ec73", "comment": "Malware payload (Vidar)", "value": "7f905cff9add06d65b9c1674ff280043fe72aa26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786487527, "uuid": "b84aff54-b3ac-49a8-a435-3c082e7da909", "comment": "Malware payload (Vidar)", "value": "673ef5c867bc44f6b7d54a94454e1fb0c14ea1a4ddfd211b264d7b0521e07c40424f5fbd5644ee5dbf2fcebf0b9c2d4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786487527, "uuid": "d869a45c-1f81-46dd-95d8-7d37575a0f72", "value": "T1A3266B03BE9158F9C095E73589B74252BA74BC4C9B3133E32E60AAB42F763C06D79B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786487527, "uuid": "94c5cf7f-71d5-48fe-b8c8-e0e07b619700", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786487527, "uuid": "c993212b-ae93-46fd-87c7-2d2651ba753d", "value": "49152:ap959FIFIi27djAmuUlFoxRuS4wqiBuJ6JyxNBKpsKCsHpwnA0y0E:aXbJlFoxRugMRsJwna0E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786487527, "uuid": "a84e8f86-3595-4190-a4e0-1a60548c8f0a", "value": 4718968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786487527, "uuid": "2d370d1f-fafc-4728-a3fd-bf2fe60cbe46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786487527, "uuid": "903f8b94-df59-4d55-a249-fe68ead5a832", "value": "93cf6b3cfc0e49213e384bbcf86d5930f96125b62e1940d7334642e40bf56e54.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beab9563-95de-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786491933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786491933, "uuid": "703410a3-ce37-4b29-bb6f-0d54e4dd4c75", "comment": "Malware payload", "value": "7b6ea636d4c93e8bb5c23d1f825b14ab", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786491933, "uuid": "3ac7df48-53a5-4a63-bbc4-e8a5d1c07845", "comment": "Malware payload", "value": "9437483dd513277824d7cf475b04ffd6bcd1c22c431718f7314e1425ac6662b8", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786491933, "uuid": "d0dd4690-fd62-4a89-a58c-c00fd34fdaca", "comment": "Malware payload", "value": "541d2fa32e74cef1e3e12633ddbd30e20f192d3e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786491933, "uuid": "6adab1cb-1bfc-480a-98dc-7cee46f1dafb", "comment": "Malware payload", "value": "e9d8228211c30e160aaa22ecf6fa53f14dc94e4bcccf144f9c8dd4e700c0237c41d21454a20fcc92e362847bd5f63ad1", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786491933, "uuid": "e6436181-dfb4-4295-92b8-68155bed9806", "value": "T1068412F5E56455A8E93FB438C1C38FA4EADC364D5D005E28D7A01390347FAD8C9B8A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786491933, "uuid": "46b3c2a5-d3d5-4be3-b814-4738e86df59b", "value": "6144:cYCorScgdjUA/ezOJnSItsxJCRul/4Kp1DEXkyXjQdyshYFGS9teO0zYbxomv:rAL/rJSItssul/4Kp1DisdteN0zYOmv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786491933, "uuid": "621714b2-d6fb-42cb-8ecc-f344eaf9c317", "value": 389628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786491933, "uuid": "e9e54b2c-2b03-4c90-93a3-b3de6fed844f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786491933, "uuid": "6706494a-c79f-4821-86a3-ac5f56dec366", "value": "kd_02_10df.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11c5f331-959f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786464585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786464585, "uuid": "f4dadab9-bed5-40d6-85ef-e2e09a3980fe", "comment": "Malware payload (Mirai)", "value": "7b4ddf132611536cddd6d8001c0b02f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786464585, "uuid": "1c9b158e-8899-4c9a-8ad1-8bf26994de9f", "comment": "Malware payload (Mirai)", "value": "94863b706d7961a671d79aa2eef95d6dd9ad4a16c3def36fda8164e5f9862f5d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786464585, "uuid": "9ae18288-f2fe-40b2-becf-e8c5844f251d", "comment": "Malware payload (Mirai)", "value": "2e5dbc43caffe8b0de937f7e3f2235027199332e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786464585, "uuid": "714e38d5-3589-4dac-8264-6e06d45822cc", "comment": "Malware payload (Mirai)", "value": "4b8f83a5fa09e1cac4e6deef8866e74e077decfbf755d2ac4d3d3bda782ebea92ff1328f62cf75a2010a4026f47be052", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786464585, "uuid": "2bea30b8-6b24-4370-bed4-583fb2f6ac63", "value": "T13924841E7E228F7EF669873447B79D259B6823C627E1D641D1ACC2101E2039E641FFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786464585, "uuid": "7360516d-6d70-4e6c-9f9f-97c737e9da1d", "value": "6144:i1QZw43t7VSmO8H0cqXQKno63AztqwIpiXcZq7V6XwOlI2ZuldT3gOVRx:DZwwt7VSmMzcYqRx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786464585, "uuid": "1c8d64ae-4778-404f-8760-f2c65b207c17", "value": 211048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786464585, "uuid": "1de588a3-e11e-4f41-bd97-c0b4d3dd44ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786464585, "uuid": "59c3c972-fdbe-4487-a8f6-c1e203dc5d5f", "value": "7bb72c87e151070f9af16dcb07db823602f0bb7ecd03f41871386c3256622c25.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bd0beac-9562-11f1-bd95-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1786438429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438429, "uuid": "d7710180-c571-43d5-9ca5-56f23e8effc9", "comment": "Malware payload (MassLogger)", "value": "3a3ff68ebedb0c23829afab6d95597b9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438429, "uuid": "901a9f73-f9cc-4d1e-bec4-18e07c88ad74", "comment": "Malware payload (MassLogger)", "value": "949457d11dd21a5d329ec259a58613c8767919149f209af66787d3ea4b626316", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438429, "uuid": "6f7f8b07-a863-4e20-9f53-e7200663bfd4", "comment": "Malware payload (MassLogger)", "value": "7312c3d84c34432bdebdb4c4e6f3fad5cecfa9b4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438429, "uuid": "92978718-37af-4a14-8d50-2d65ac6fe2cb", "comment": "Malware payload (MassLogger)", "value": "e094807cad8bffd0470d81cbd5c4da06c3885cbfe9251d3c870b9846684543c79a483a48b7b1ef415fb24e63a0f656b4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438429, "uuid": "d941a35b-9a23-486e-ad11-e3bec5d52478", "value": "T1D4D5310D457EE11A60616C20DB80A4A1637E9D8F8F5F059B164F89FCBB8B12805A7FFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438429, "uuid": "b8448245-e9f2-4804-8e08-36805f0bdbc3", "value": "24576:64mSaXvCoggN5BLz3nVMiJ3CnHdxBm0azl+NvHJ5eQqr9C+8n/K/BdIXMLnrxkTE:VaXy6E90l8/I5guw0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786438429, "uuid": "b54d1b3d-dbfe-4d79-a404-9ac8b0341a82", "value": 2921502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786438429, "uuid": "94a33f44-2c89-4212-ab36-27f26ced8f98", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438429, "uuid": "763733ac-6b88-426d-aea6-915516781239", "value": "PO-086809-NO-09797-08-26-PR-09797.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "409d3c6f-9591-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786458651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458651, "uuid": "6b141c2e-e138-49bc-a5f5-42a9ddf387b5", "comment": "Malware payload", "value": "8e0d9c05f0b75228366972504cd6ae32", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458651, "uuid": "b28ec8a8-4d7d-4523-b883-e7928245bbf5", "comment": "Malware payload", "value": "94a80b77567f9a3208561b5b9cfd4a6e1aa0befda3b746781443709d02fe3618", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458651, "uuid": "8d75606e-3d67-4d89-b4c9-20f31dffd790", "comment": "Malware payload", "value": "21c86d97dbdc4a5a98ccedefa553c8f615c29aef", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458651, "uuid": "5ef2ee48-d41e-4ff3-9306-a279468548a8", "comment": "Malware payload", "value": "dd64e27920042121d9408de19a62ff15bc2e8a938af1de6e1ac1b35ad13d70ee7b1d21a1e0e32facdfc85e8b744d8c75", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458651, "uuid": "f99787bb-9b56-4bd6-be7b-e0b0203cd3e7", "value": "T1DF175A7CE2EF67ADC84CE9DE462C43ECEBE074D06C6A4365544B8908CBD49B50099DFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458651, "uuid": "16f2ed65-7414-4f36-b0e1-f6966a476a87", "value": "1536:V1djXXcDXa8D1cn84XS4F26TPyRV121VBdjvPx8CVC4hDV8I39FIpwjchmwwAaTy:CiSX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786458651, "uuid": "c5dee3be-d9ad-4679-83a4-52e47b3e5d28", "value": 18903314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786458651, "uuid": "89e632b1-eb30-47a6-912a-b719e74ba6f3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458651, "uuid": "867262ce-e108-45dd-beb0-d46397438b38", "value": "request for quote.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8986e411-9524-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786411958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786411958, "uuid": "6ba9393a-b48e-4cdc-8da1-d3a125b40e45", "comment": "Malware payload (Mirai)", "value": "b55d48b67985324115c29f2378633091", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786411958, "uuid": "f21ca43e-6f12-4680-b128-27c5a09219ec", "comment": "Malware payload (Mirai)", "value": "94ae81675ebf3620fa2c5acb37cb9d8d5afe0521cf97eea5242c12fd52f58ad2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786411958, "uuid": "5025b925-c5e4-4696-910f-91d1c7dd15f9", "comment": "Malware payload (Mirai)", "value": "9dd0f0d57429a8f86b29bdf1546b7ae805ef6dda", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786411958, "uuid": "ad135105-4f19-48b5-8bf8-bd66baa13f12", "comment": "Malware payload (Mirai)", "value": "c72e986243db4f0ba68685c27a6722570dadf21df668fdb1d3308bab82919286595f973534f9cc747b8ed498789522d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786411958, "uuid": "68da1f13-9868-45b6-85a8-c760d1692289", "value": "T15313F946EA519B05C5D232BEFB8E414E37136FA8E7ED32319D306FE013826E71A39525", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786411958, "uuid": "6fe2f22c-083e-4045-b575-ae8f5df5d106", "value": "768:HknCu0aUfRP/JfFUpNUL0DkmUPjUCXQBilC9wNlsnOaVnv4W:HknCBaUfRPB24L0Fgj8BilC6NlsT4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786411958, "uuid": "498c04a7-6899-48b1-b785-9c5704cecfc5", "value": 45008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786411958, "uuid": "5a5878ee-b5e0-4063-b6e0-ffa6af5c81ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786411958, "uuid": "30e83c85-37d1-4a26-b13e-6e0208bcee81", "value": "main.armv6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab489c31-95c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786482022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786482022, "uuid": "d53b1b45-5d7a-4588-8fa0-897a5aff770e", "comment": "Malware payload (Vidar)", "value": "6df04d32c54a9661fc353555390b9afd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786482022, "uuid": "e7a6a50c-170d-4c14-8da4-d2f94f0ffe33", "comment": "Malware payload (Vidar)", "value": "94b36640510f414844ee3c674da7fb0dfd52b19004ebf920169d8779aadbbfbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786482022, "uuid": "51502eb9-2868-4b4b-8243-5ee9d308afed", "comment": "Malware payload (Vidar)", "value": "ef9c5f89d3f9d0846a0e1bd85771ea36bba37c55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786482022, "uuid": "587623cb-071f-453e-842c-3bf83e4017d1", "comment": "Malware payload (Vidar)", "value": "876d51ffc2c8fc03a566b5c3361b024b77b9dc636e7f45d18949b1217ad135a99061fb039e9489cf626d6343ae625085", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786482022, "uuid": "297deb57-4b8b-4909-b60f-212622b92cc5", "value": "T1AF265A03BD9508F9C1AAE73188A752527B74BC4C4B3123E32E50BAB82F767D15E35B94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786482022, "uuid": "5d0dd0f8-06fc-4c08-bb8d-e9687ebd30c1", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786482022, "uuid": "24721a4b-5b1c-4bec-a003-13d7375233c3", "value": "49152:Y+GxjopZnp48Bf3UPX9amg03WbHWvo5ohJaW50+yorDgqjcEm:YtcJ2NaShvj50hLb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786482022, "uuid": "cd15ffda-3584-4a15-9b0c-16b4b581544e", "value": 4599144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786482022, "uuid": "000643b0-9a16-4e44-8694-292197c49b67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786482022, "uuid": "77a15a17-0dd8-4445-8380-9d360e2e869f", "value": "94b36640510f414844ee3c674da7fb0dfd52b19004ebf920169d8779aadbbfbd.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afd00826-9562-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786438651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438651, "uuid": "c97b84d8-43d8-4c97-a712-64fa2d3fe33b", "comment": "Malware payload (RemcosRAT)", "value": "4996222ec81a2fdc3977735fa9ef576c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438651, "uuid": "5ce25d0e-091a-4b43-8a63-d0302365dc04", "comment": "Malware payload (RemcosRAT)", "value": "951733b48a1c2f489be7b7bf43716cacd4b968a3ae7f67e98290d3f70887566d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438651, "uuid": "ceedcb22-b7f9-4d25-8cc5-b02b2e3b7614", "comment": "Malware payload (RemcosRAT)", "value": "f075a6a47f260240bb5f0f3ad055d63bd49f8702", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438651, "uuid": "41c16ac8-ab12-40d8-b768-766bbb598f95", "comment": "Malware payload (RemcosRAT)", "value": "357777951a7b8b3a01001e022aad997cb4cf02d09c93f107880acc4ebe923b5080c376091e47121b3cfc6de4eaedf52a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438651, "uuid": "c7bdabd3-187e-4d39-9853-e4b4a758815e", "value": "T1B43696E172FE36030912316ED81D5C188F5EE9340DC3A1D9F0CF7E85472E9B65AA4AAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438651, "uuid": "3ba26985-36d4-451f-b0e9-6acd5a07cd51", "value": "12288:YU9DISPJ5qHmqUzemFXPdtpJcrnK/+92ovAb7Xv5jtBu+R/uKmZvlb7wMXK4+ZEA:YokkYLuNR1j6njdM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786438651, "uuid": "7a9afadd-3aaf-4933-a795-728202dfc7a0", "value": 4905774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786438651, "uuid": "62066828-e337-4352-bcf2-477718e69a3d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438651, "uuid": "55db0ec8-31d0-435e-a09b-bfd63cf69913", "value": "Payment Receipt.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cea7cb23-956a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786442139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442139, "uuid": "67804cc2-736e-45de-86e9-a867415ac638", "comment": "Malware payload (Mirai)", "value": "9302a304458de8c5b907d9716be5c6a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442139, "uuid": "e30f1fb2-b8f5-4448-b4ec-1380c5558368", "comment": "Malware payload (Mirai)", "value": "9582dca80a0e9fc58a2d79db8e7d498ed24fa4962b9172ae63c653f2d6f25e79", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442139, "uuid": "43855197-1a76-428d-963c-7c9617c3eb99", "comment": "Malware payload (Mirai)", "value": "c279b4f61d94cc049ba78d30dfc752744ad100a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442139, "uuid": "d514becd-d6c7-436d-bd00-6c9611b2f7f8", "comment": "Malware payload (Mirai)", "value": "80ddcf083b0a06c36685cafb803e810c1c4ef24584a8744d67c435893b3929fd75f8ec640dfe576babcd2af38d206fda", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786442139, "uuid": "45d1af40-8efd-4ead-b14b-9ae7e0f17d7b", "value": "T190049F73E8256FA8C1A58174B0F48EB51B23969041876EFA66B2C3764047D8BFB1C7F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786442139, "uuid": "c15f461a-bf68-426c-a855-78d7cc12cfea", "value": "3072:WLz2cU5Xsd18lUX1g3s1QB4WJTb8zpZIM:WWGd18lUX1avhJToz3IM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786442139, "uuid": "e6d0d48e-08bc-417f-be50-82530ec2baf2", "value": 180248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786442139, "uuid": "00e2dca3-8497-4705-be84-b079ee3ca6f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786442139, "uuid": "2696441b-38c8-4f5e-9f6c-4e4c96c538bb", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3094b30a-9569-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786441444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441444, "uuid": "35fcb3f0-2f9b-4133-89ba-a7848a0f3d4a", "comment": "Malware payload (Mirai)", "value": "a765bdc547529027dbd1715763b608b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441444, "uuid": "20bfdcfe-5a20-408d-a26e-a418babe8bac", "comment": "Malware payload (Mirai)", "value": "95dc51e8aa93d31f76f35ad29f03793fb0984ae2cabc5362f8b41d3994f69cbe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441444, "uuid": "d556df33-c934-4640-a407-6a7ef3184cde", "comment": "Malware payload (Mirai)", "value": "df0b03f6a93633c8de5308415535446f72a539a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441444, "uuid": "0dddaedb-44e6-4772-bc46-7dd7c7bb8550", "comment": "Malware payload (Mirai)", "value": "5ab8e1241400a007a4be823a5d6031e67b17f61fc18778671da79d3335dfb7f938a1bebd9c17a02838a02ead6f612782", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441444, "uuid": "932dfcdf-2476-4883-8a5e-8098eb0ff79d", "value": "T125342A0775C08DFBC4C68AB51BE7A1328933F8291732665BB3A8FD951F0DED86A1D604", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441444, "uuid": "db9beaaf-2fca-431c-b3af-a1e2c13e4592", "value": "6144:VvReiaJRvzIFlmMTGkmqHgPhqa0KHW73tNl/:VvReXJlkmqHgPhqa0KHW73tNl/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786441444, "uuid": "839baeee-548b-41f8-8c3a-ca2b284a9946", "value": 234811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786441444, "uuid": "fa44ccfd-6302-47c5-98f5-8b9d1dbad9cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441444, "uuid": "4b8ea272-2ad3-4c39-9d93-cba9aeedb0cd", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6d17eb3-95df-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786492350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786492350, "uuid": "813afed1-aaa6-4237-a42b-639b9bf039f5", "comment": "Malware payload", "value": "2691862c8c1382b44972076bc4230276", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786492350, "uuid": "d56d6e85-17da-4329-aa0d-e8129aff87c9", "comment": "Malware payload", "value": "960445d80dd38bdf5a3c7846088f54ee9f7e2af2e6631a1113648a4a742ed723", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786492350, "uuid": "c271c9c6-ca27-4d8e-b9c4-000c1720e4c7", "comment": "Malware payload", "value": "845d3dcda0c3b6f5245c71b1d96036afa90c5d9d", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786492350, "uuid": "de4273ae-f618-4318-b0d5-ca17379b7ed7", "comment": "Malware payload", "value": "7d46a347a57e81e4acb29b472fafa8b816375135914a3dac7db9bb3a4d87bd042acfecaf3ba6d7c250fdf4656f77f136", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786492350, "uuid": "862710f5-a551-447b-a2fd-522a9e882385", "value": "T143D6330228E173BCD9228174FBA116A7D6ACF0752F329FEBA15DC2992C475F09DB5087", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786492350, "uuid": "e2940532-f3bd-4d3c-a142-19c8dc1ca9ca", "value": "976d2ad389e8b21847d44dfb70916b1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786492350, "uuid": "1a4a99cb-0423-44a9-84b7-af5051d47538", "value": "393216:bNkVE5+CEvxe2oGHmipgRW2HbDXMCHWUjXcuI3/PGTAI:bNkXvxFxpEXvXMb8sH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786492350, "uuid": "94b9de63-9ea2-43ac-b812-1839aac04b5f", "value": 13855798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786492350, "uuid": "e70c1344-9521-4bf1-afe8-93f73721fb15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786492350, "uuid": "3016ee80-01d7-4467-bfe0-b9d0fc4942db", "value": "composer.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8c0bd80-9569-11f1-bd95-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1786441780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441780, "uuid": "fd08cbae-ba08-4853-9a2c-13a3e4f51ac8", "comment": "Malware payload (Gafgyt)", "value": "4ecfec4f369bed2b4c8b83ee749bd0d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441780, "uuid": "534a5a27-6c8d-4e26-a246-ff640367c1ef", "comment": "Malware payload (Gafgyt)", "value": "9680789e5b74e294572da7ae8030d1632a60010b3c9fcab7a4eff824725f6435", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441780, "uuid": "cd3a652a-1c1d-48e5-bca4-7cf207bec37c", "comment": "Malware payload (Gafgyt)", "value": "a6528105ff45eeedd9eeb7b1c0682737fd74389e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441780, "uuid": "dc7fd32d-5a80-403d-bb79-7ee081adbf68", "comment": "Malware payload (Gafgyt)", "value": "7699f84198109426280d5be63018d67b87cd6a2c9d64f5e68b45807614c60605c3b3257b78e2bd124b5d8185ddf0cdbe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441780, "uuid": "1974e766-5e04-49db-baf9-7c178343e2a6", "value": "T1A2D31A04E551876BC2D2137AF79E469D37331BA493DB33215A34ABB82FC179D2E39821", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441780, "uuid": "583e09d5-a63f-4de7-b790-a394d73e9a3b", "value": "3072:NQe3TQbfKa/XMVky8hGSfvPW986SLgmFQwYvQX8T7:p3TQbCafVBvPdLgmFQwYvG8T7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786441780, "uuid": "b26457ba-59cf-40f5-aa98-66d4f20f00ef", "value": 135625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786441780, "uuid": "8ff5167c-1a3e-453c-9111-938287004962", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441780, "uuid": "01abb1b5-05fb-429c-bacb-f0c4536def25", "value": "a-r.m-6.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e878ed7-958e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786457278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457278, "uuid": "19e8fae0-7a67-492a-bee3-5501b9bcfeba", "comment": "Malware payload", "value": "94767672fe0d9f5546c4d099ec5efeda", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457278, "uuid": "008d386a-f103-4d0a-be3b-88014adf39fb", "comment": "Malware payload", "value": "96e6f9aafd49676aa9674a02320843bcead7c78ee077b47cb05d1b252e02f6fb", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457278, "uuid": "97b6cf24-7c9e-4c1e-b0d4-913b01d0805d", "comment": "Malware payload", "value": "be09663a5dba9267076698c42dfe0330ee2f45e2", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457278, "uuid": "97960787-7a50-4f82-b20f-946279276e99", "comment": "Malware payload", "value": "f65aba46d204b05519d8e61f596ffdea7cc89bf8b52c6023df24518044e284d187a1905f6eb6d512c6322db1d468084c", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457278, "uuid": "b3b68c07-b22a-44bb-a528-ac713a8e300d", "value": "T12C76C025392FE2A1DDE42C76DE5D7A8DC153AE8ECD292103B10EA326417737672F8B44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457278, "uuid": "051c5dfe-64ec-49fc-87c0-dae7692df7ca", "value": "8606e20dc0fa15453b9f51a8e1b5873c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457278, "uuid": "66008b5a-0a69-4013-9a06-0b316e8ca94e", "value": "49152:GfbdgF+h43+vit7NhC3sEQn89ufZOTXIaDDYFOV1rjmtVyNEM2Kj7Rs6m:GSFj3rgt9uf0TYaDTV1EwVPjds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786457278, "uuid": "eaaae65b-2011-4ffa-bf82-d1b0004d5322", "value": 7485952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786457278, "uuid": "f823c6f3-230c-4e21-a6d5-fedc5e844e22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457278, "uuid": "bd119f46-0c9a-4d1a-b797-0cf4b6fe024d", "value": "RobloxPlayerLauncher_x64_v2.4.17.exe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca939340-9561-11f1-bd95-42010a9c0009", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1786438266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438266, "uuid": "1729f746-40ae-4deb-9486-e59765d7835a", "comment": "Malware payload (VIPKeylogger)", "value": "2fa95a30ff4a919b01e30885cebfc3f6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438266, "uuid": "551cd6e4-be77-4d04-a987-cd1574d74eda", "comment": "Malware payload (VIPKeylogger)", "value": "97029e7e2fc05d3e1232a035f8a7cc0044e17a8d8cf3a27a3bc04b2064a156e0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438266, "uuid": "e6028564-ac2a-4aa1-9bb8-31506853189c", "comment": "Malware payload (VIPKeylogger)", "value": "1731344f325c2ced9310c2c7279011ae7f99d01f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438266, "uuid": "2bf2a8fe-c020-4bd4-9d69-5414db9badbd", "comment": "Malware payload (VIPKeylogger)", "value": "e0418952cc7080f5c0679319bc8dc717fadf9ff3bfa6ed88751d8928b18999ecf1fa8d629f909f94687852da973cb740", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438266, "uuid": "71da65d5-6362-4e33-9c01-976da45b99e9", "value": "T13005BEC99150DFE942C22F85B95861CD10E1316B83AEE90E8064B6D7CC3C9D77DC9EBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438266, "uuid": "0b3e506d-7fb6-4653-982a-fdcfd6ea682a", "value": "24576:qsFM3/MZsXydrYCQ/TuqoERglmfetvL1gxHh7ldlCgpuffB:qMMPMZsy6CQ/TuqzRotvLuphPlCgpKfB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786438266, "uuid": "23d90d2b-af40-4468-ae9b-4d146ef227be", "value": 833978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786438266, "uuid": "8d7006eb-bc08-4ca8-abdd-c6279b7f47b4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438266, "uuid": "f577d9bd-a16d-417b-ba2b-b42445cf9a49", "value": "COTIZACI\u00d3N.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03dcbf30-958a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786455542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786455542, "uuid": "77ff0053-a928-4d95-bd12-0c4fbae8ef4e", "comment": "Malware payload", "value": "67df85e1c5b06b619c5249cfd231b3e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786455542, "uuid": "c4a98789-2675-4ee7-a8a7-c5af2385f17a", "comment": "Malware payload", "value": "97212ba867fb422f25009bcd9cfd4867cfcd7511c9ee37ff4361a98a8fed3019", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786455542, "uuid": "27e3b948-d49e-46da-ac70-183030c0d0b2", "comment": "Malware payload", "value": "41b11872fb664706ca3c17c1ff805d97a57ad69e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786455542, "uuid": "303a7c8d-dab7-4f6b-b603-46bb5486faa6", "comment": "Malware payload", "value": "9c10ff22a71b403823fa1bb3f2c3315e44ab6ec7687bd630d4131908b66e8f4e95a83939012f8f1b5d9f20683e58da12", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786455542, "uuid": "824e0248-712a-4e91-96fb-620c70817a82", "value": "T17013C647672E0987C0772EF03A7B27F087AABDA112E49540565EFFC14235EB06152FAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786455542, "uuid": "6e18ee7c-b604-4d63-b56d-95fb209e6dce", "value": "768:/lS9ZTMOp6X2SA8QdFnnhLfNsNADwexZ5555555555555555T55555555555555G:doT13tnh6AD9y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786455542, "uuid": "3ff0c775-c7b2-4acb-859c-946e15c2d201", "value": 44604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786455542, "uuid": "d42019ea-0d33-4a46-bc1b-f5f97836c9d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786455542, "uuid": "e9dc27c2-82d0-4625-b5cb-70b8c4efc956", "value": "main.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dd0a716-95bb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786476846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476846, "uuid": "ee3eb42b-c580-4585-a75a-c4a9fe591ef7", "comment": "Malware payload", "value": "235b0051abc7176679dcc0d516576a64", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476846, "uuid": "755dde94-086a-4384-afaf-daace89eb429", "comment": "Malware payload", "value": "974c2f56d12122b84439d53ac853e483a1f2e2334f8d207f90cca3888cbf48e2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476846, "uuid": "925cc63d-b07c-4701-a079-01b935f3d305", "comment": "Malware payload", "value": "441d2fc1a30999e2e10361da17b6c69663b268fb", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476846, "uuid": "010feebc-8192-44b2-8932-ab0f0dffeadb", "comment": "Malware payload", "value": "29fb1ec32bfa5e8e696bd25c80d7be7632aed903e04bc14b975b0b84e21db9a069c136edbc3ee26390070648db8ea7a4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476846, "uuid": "b2a4dc6b-c772-4da1-83dd-ff1b0bb577dd", "value": "T124236C651A857C24AA98D4371D7E2F0CBDAD43E6320492DE7FCA3CF28C5AA9DD10871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476846, "uuid": "1b8cb437-1ad7-4e72-8c95-69ed6741ebb8", "value": "768:KXRWNGxVZ9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:2lxMcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786476846, "uuid": "9ad03fe9-2462-4e01-90ae-91f7addb9556", "value": 50043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786476846, "uuid": "04dc59cc-1bee-4b23-ba63-229fa9838d9f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476846, "uuid": "19640cc3-1dcb-4b7b-aeda-21f9605f101f", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4d9b5e0-95b0-11f1-bd95-42010a9c0009", "comment": "Malware payload (ChromElevator)", "timestamp": 1786472267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786472267, "uuid": "7e696d50-258b-43c7-8662-b68985fd9d76", "comment": "Malware payload (ChromElevator)", "value": "a9156bc7288e06c94dcb2ecb5c8c7ae0", "object_relation": "md5", "Tag": [ { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whale-complex-site", "colour": "#C287B7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786472267, "uuid": "3bd7a886-36cf-4068-af40-39b41dc344e5", "comment": "Malware payload (ChromElevator)", "value": "978dfaf86590b15d5b443f84f10c0400f5590c4456fba7238812c5e6e96a24e5", "object_relation": "sha256", "Tag": [ { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whale-complex-site", "colour": "#C287B7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786472267, "uuid": "e59d61f5-e3a4-44ef-928d-6c51820b019a", "comment": "Malware payload (ChromElevator)", "value": "68211ea7d2d3c95244a321ae7bdbf2ff223c33ed", "object_relation": "sha1", "Tag": [ { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whale-complex-site", "colour": "#C287B7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786472267, "uuid": "ced66776-0286-4cbb-93db-97da05a7f33e", "comment": "Malware payload (ChromElevator)", "value": "41512228f83105452643fc1c9cbf47413461ebee76eefb27f7eca4dfaa65ffa8fcc8614314ddf78fd3f3e905899c590b", "object_relation": "sha3-384", "Tag": [ { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whale-complex-site", "colour": "#C287B7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786472267, "uuid": "4307d49a-2e0c-46f9-ae57-2ebeadc7f94a", "value": "T14AE31857E28320FCC55BC17846969772B671B8260324BE7E7798DB312F10E20BF79A19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786472267, "uuid": "e17799a4-cb8c-4748-941f-450b502becc1", "value": "e86c39dfaa1809de0c726444054bbeb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786472267, "uuid": "8df1c30d-0a3b-4860-aa28-2a7e69636734", "value": "3072:ZVVQOnrFGZDpi9zx6srqYLMDfsleKdyWPPj9Qx11:ZVHYDpiu+LYslaWHjw1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786472267, "uuid": "49fbe565-6254-4d5d-93c8-8a14cdad9916", "value": 147968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786472267, "uuid": "09778af1-49d0-4f7f-af75-6a6a2cc6e888", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786472267, "uuid": "6e61095d-61e7-41f1-a993-75668b63ae09", "value": "Megabasterd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6a5634a-958c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786456728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456728, "uuid": "ce2b0e84-56ec-4857-aae9-db1c6541b0a2", "comment": "Malware payload (Mirai)", "value": "3499d06114e8a6ec77c68a861af98c4d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456728, "uuid": "db78c2b7-1aa8-48f5-b861-be38a70d24f2", "comment": "Malware payload (Mirai)", "value": "979bd80a9ffde500946e02911d2824eab5fb25c265086b6569e6fff6977d21a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456728, "uuid": "6fa629a0-9c8b-4608-947c-d07abd8647d1", "comment": "Malware payload (Mirai)", "value": "b71a4be437ad29517f92c9932052ef93d7a9869a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456728, "uuid": "74fc676c-bb25-4dc4-b77b-31a7fbcaf727", "comment": "Malware payload (Mirai)", "value": "51ca8440a7ba03b14a3fff72ec89e7cdd321a305db95f7b7128ff78bf020cd2c925a6bc1069d06505f771304dd7a259b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786456728, "uuid": "636d772c-150d-4021-a1dc-0927049a30aa", "value": "T1CBD39FC1E743D0F5E85205F0103BA7318B7AD53A943AEB96D7A93E31AC62A419B1B35C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786456728, "uuid": "0e415e9f-09d8-4e10-965b-a278128a3234", "value": "3072:itqlV/o6aopCtw4EX4HHTfmqx1Gyx0Jhf:itI/DGtnldxQo0L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786456728, "uuid": "41bcbfb9-b01c-4e2e-9b87-858313d8c971", "value": 133452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786456728, "uuid": "b4abfafd-3770-4dcc-8840-53e67a82545c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786456728, "uuid": "953436e7-736c-4cb7-b353-df460bd088ac", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9080774d-9569-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786441605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441605, "uuid": "34e8ef95-f60a-4aff-bd52-27e4eda38eb3", "comment": "Malware payload", "value": "6ddf4992880cad458ad46c0e8dab8226", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441605, "uuid": "2850ca59-eaa6-423c-ba4b-442074f85f74", "comment": "Malware payload", "value": "98b06255620ffca97cd23a94135f8da4e48233e0998b715005dfbc7df7b02da7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441605, "uuid": "aa6adde8-17b3-4142-867c-965dc211df95", "comment": "Malware payload", "value": "d03b5bb60d7d0fb952d09843ab171260e4be076a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441605, "uuid": "939cea5b-d6b4-4752-afb2-eec99f3fda26", "comment": "Malware payload", "value": "902b7442c95922c16722a70cfb0d0548bc1257b9beffdcec5f9fe6d7bac3c94b2a28eb426bb9c4e676474707ef5d8a60", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441605, "uuid": "6e550395-1de1-4012-b14d-65f75c2c6f84", "value": "T167E02682341241328ECDD45B415BC498F08221833C817A2CE42B66324A9C1E4F262FA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441605, "uuid": "8d3738c5-001d-4d9d-ad3c-2f8f3263e5e4", "value": "6:hqyBolfUzB+QFnTAJ3lqLeBsA+TxafpJTxe5plVOCfRX50:8yiRpQFn8J3lfcafpbgpTOsk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786441605, "uuid": "cb249ffa-eccd-46a0-b35b-afaab6c2ab9c", "value": 324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786441605, "uuid": "3e2d301b-316d-4fb3-b073-f5a88b0f3dbc", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441605, "uuid": "fac441bb-13b3-4dcc-8083-d53c86159b8c", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d34fe088-955a-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1786435275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786435275, "uuid": "72342bc0-b171-4a0b-8315-ab34c689d538", "comment": "Malware payload (ConnectWise)", "value": "1060c146fcf1068a96a6d41e756480ce", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786435275, "uuid": "bebe064b-2b6a-4caa-aba8-66ece6aaf6ab", "comment": "Malware payload (ConnectWise)", "value": "997fb4c71e0ae8b191955d85ce65f62af128c8609964ef2735bae557af5c772b", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786435275, "uuid": "d1f15c36-89bd-4a22-995d-1473768e23c6", "comment": "Malware payload (ConnectWise)", "value": "ea6e97ccbf255e94015a61f0f0a51ba88d43ea7b", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786435275, "uuid": "20d87e60-af3b-48e9-aa8e-7f4d3b98ddba", "comment": "Malware payload (ConnectWise)", "value": "fa1d2caa57ccb61bbd234a5b41af9601e85f38bfa15722ed21053555785aabf498ebf5adc5ae3eae0c1c6cfaf0f6c88b", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786435275, "uuid": "3821fa55-1cd2-41cb-9e55-6fd35e577b7f", "value": "T1A2C61201B3D689B5D0BF0638D87A56665A34BC049712C7BF5798B96E2E32BC04E32377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786435275, "uuid": "c421166d-09fa-4de2-aa9d-8ba675c82edb", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786435275, "uuid": "f2446b88-c5ce-4889-a4fa-d80786904dc4", "value": "196608:E1TfefPqVQyiixtMjGZ1jhlrwUNQyiixtMjoQyiixtMjXQyiixtMjBQyiixtMj9:EmPnjGrrGPnj5PnjgPnjqPnj9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786435275, "uuid": "cbf70022-9d16-4d4c-a4b6-c6121415150e", "value": 11624136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786435275, "uuid": "7bbfa07c-05dc-42d0-b26d-ed923ecd2f39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786435275, "uuid": "7dd9bfa9-02ae-464d-9aa0-1e2bc38ef3d5", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e65fe9a8-95ab-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786470096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786470096, "uuid": "227a59dd-eb50-4148-a584-769572b9f75f", "comment": "Malware payload (Vidar)", "value": "c5289d3980fc4e79f999950f5b0f869c", "object_relation": "md5", "Tag": [ { "name": "188-40-17-238", "colour": "#8E5B4A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "YodaTeam", "colour": "#165E22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786470096, "uuid": "f683ea9d-7519-47da-a875-ceed843167a4", "comment": "Malware payload (Vidar)", "value": "9993b81fa94e2a2897179d38c9d0610b2c4d3af7aea4f41cbe31a286050fd9be", "object_relation": "sha256", "Tag": [ { "name": "188-40-17-238", "colour": "#8E5B4A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "YodaTeam", "colour": "#165E22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786470096, "uuid": "a85cb821-cf94-4601-b826-428aa27865e8", "comment": "Malware payload (Vidar)", "value": "37e667d7f4d0eec83e28076abbcb9f5916bba86f", "object_relation": "sha1", "Tag": [ { "name": "188-40-17-238", "colour": "#8E5B4A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "YodaTeam", "colour": "#165E22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786470096, "uuid": "280c8c57-31ce-4ded-80da-5864dde10e06", "comment": "Malware payload (Vidar)", "value": "27e87a8457a4e84d9db96b3f8f32ebae4ab5150a7ac35a013e35060a1e248b8deb7ccf77676315121f1a075db679d05a", "object_relation": "sha3-384", "Tag": [ { "name": "188-40-17-238", "colour": "#8E5B4A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "YodaTeam", "colour": "#165E22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786470096, "uuid": "baf2109e-58f6-4c70-81bc-99bed6da560f", "value": "T179D633607B849DF1CA25C131CF8B931384FAEAA617612E8F936D0FA36E538544627DF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786470096, "uuid": "6124ac78-05a1-402a-8dbf-ad5b6e3a9494", "value": "b5a014d7eeb4c2042897567e1288a095", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786470096, "uuid": "404e4063-40c0-4a2a-b5e9-2e59d53328ac", "value": "196608:+pqhFibraNKhwEOoiBA8WaTDfG+XOLbiQZMnxfEwHmMLO1PZitDSlGdnQchLa1cw:+pqTibdwEhNeaZLWQt985S8nQchLU1d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786470096, "uuid": "5ce0c967-f4db-4b74-9d05-eeaea42c1c29", "value": 13364351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786470096, "uuid": "70993821-d647-4f91-b313-757c0e92af76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786470096, "uuid": "7699ce2a-c7fa-4297-9aa9-f7c4ee16985d", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2625e565-9597-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786461183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786461183, "uuid": "f18c8bdb-1a40-402c-a56c-d46aaeebd9e2", "comment": "Malware payload (Mirai)", "value": "29a719e938c7ac9e1ef3b0883496f4c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786461183, "uuid": "bc1adb64-4b3d-4248-b4b9-37ebe0201586", "comment": "Malware payload (Mirai)", "value": "999b2459d4baad086b436e58f1a323f3a36927edaf17184824631ef76fdde393", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786461183, "uuid": "fd1e8c06-b21a-4226-948c-1f3539066aac", "comment": "Malware payload (Mirai)", "value": "4d5d19403ae8f82b5aea1e2230b96c95dd059c68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786461183, "uuid": "edac637b-9c43-4c25-95a1-4580677745ac", "comment": "Malware payload (Mirai)", "value": "19bc5e3e6d770952cf091e94586e5ffcf5bab56963e6997704c49ce1b8aad29b5f0445f410dbb6c1c9676b514254be64", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786461183, "uuid": "5a6efb22-ad42-4ff7-b5ff-40653400364b", "value": "T1A7F2F158BB820D31C3E64CBAE83A894932AB51B8D8DE725516770561D2E2C09DFF1D83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786461183, "uuid": "c79fff2c-7aa0-4f29-9e52-08102f1b77b5", "value": "768:9LnK+3y7XGKVk1gLeFFFZ1jZCJQ+5WUA4Tdxyx7992IwoLPBEN9HOTs3UozRC:5K+iTkCLQrZBZun5WUA4TdcN6mJoLz0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786461183, "uuid": "7af934a3-2c0b-4405-9f53-5bb6df8a56ed", "value": 35072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786461183, "uuid": "c7d77e12-187d-4912-bd0f-7d14f94dea72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786461183, "uuid": "b0d7b90e-e323-4884-85c0-429145ba6031", "value": "sdfjgnjsdf.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "451432e3-9591-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786458658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458658, "uuid": "75d504e4-a5b8-41ee-adde-47d5f18565fb", "comment": "Malware payload (RemcosRAT)", "value": "0b62a3c403ca14b9a749fd4c6570f235", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458658, "uuid": "96e0cd27-8516-440b-bc94-4cee3eda6e38", "comment": "Malware payload (RemcosRAT)", "value": "99baff0a339c9ef6cecae9c1ea5d6af3a9305840ab163ef410ee89d0d5dc9ae5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458658, "uuid": "6065621e-dedf-4dad-9f96-8389fed687e9", "comment": "Malware payload (RemcosRAT)", "value": "55320e175e473bb6469f1910da336c1fb539b100", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458658, "uuid": "e0693c00-e0ec-41bd-882a-b823107320e6", "comment": "Malware payload (RemcosRAT)", "value": "90a95ceb70ef27be29db28464c060ba44c43117dd9eb35a691b46669fca6d8eeb399b26463412766da8702d20f1919d8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458658, "uuid": "75726eb3-ac7e-4221-9aa4-af0ad25962d4", "value": "T1D1C41F1D457AE00A20216C60DB85A4E1637E9DCF5F5F019B164E88FDBB8726802A7FFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458658, "uuid": "8670c699-1d97-45d7-a6af-dae240069540", "value": "6144:AUz56ATbEvDr9NS0iP7PQB5mnAIFyCdFnn1kf4fOk8TgToxER3Ru:AGR2r9EPjQWAIPjIg/mg8xERA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786458658, "uuid": "8ce8c9f9-84e9-4cb0-ad0f-fb1b5204fa61", "value": 549522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786458658, "uuid": "056128b2-24e4-40d5-a565-4b0a8419adde", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458658, "uuid": "8f36a4cb-6531-408e-869a-98d8a44b50b1", "value": "RFQ-308600900001.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e5f94ba-952f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786416476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786416476, "uuid": "1848e990-1be8-49bd-9e67-8334612b9771", "comment": "Malware payload (Mirai)", "value": "e34e56850d5a3db24ec0763f39ec3526", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786416476, "uuid": "af1a473e-05f0-419f-81b0-997b07047b59", "comment": "Malware payload (Mirai)", "value": "99c33754a4749131c6df0b2f9f76e052fde4a8c2d5f259eb72e9c8a0c1a6294c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786416476, "uuid": "58b32e9c-9938-4348-a363-6ccefe9de720", "comment": "Malware payload (Mirai)", "value": "22d8a76e3927fdaf4ac37833d13cfb9c73841301", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786416476, "uuid": "73520f84-7d7f-45b5-88ff-0ddd3b8eef5e", "comment": "Malware payload (Mirai)", "value": "4a81236c75fa7b0ec7c1c2cebd2151b2ecbdc42eac7d989609fa93c36b4074883f970fd2b0405ff174e0a487ee48649c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786416476, "uuid": "05d74668-9d56-439c-bace-2a76a1719efd", "value": "T1B0014CC688446D0050DAD95E22D75169F820D3CF164B4B7AFFACAD3DEB94904F066F84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786416476, "uuid": "774fea1a-f9d1-4039-b658-d41d8ffa8e74", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkauNFCa3nCh5gCXEwpCm5c+sCoiX:kXCKysE2hi0ziQvZohauXrX0hp/5cd4X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786416476, "uuid": "e17c528a-868a-413e-bbd2-57e1a4c743cf", "value": 848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786416476, "uuid": "25f4025d-1c4f-49b8-b262-87773cd135de", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786416476, "uuid": "e66ff055-0ebe-4e0d-986c-b4b03644aa6f", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f25633c1-9562-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786438763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438763, "uuid": "824b1196-aa82-49be-9faf-2e39c1a6aa1a", "comment": "Malware payload", "value": "90035cc5e5a6e98b3dd4489b7086f1ec", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438763, "uuid": "502fac0d-8f11-4b99-a473-1f0dbc58cdd3", "comment": "Malware payload", "value": "99d031e1d29cc2711f9223e8152016ff58ad68fd9e14dce5b0a8dadfb741b088", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438763, "uuid": "2e854843-f30c-4718-899d-532f8d583c3c", "comment": "Malware payload", "value": "2e8ba53a8a3a2bc73716b6d47dd1e1d9acce08b7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438763, "uuid": "40560cc3-13bb-40ba-8688-aabdead19e56", "comment": "Malware payload", "value": "663d3ddf8488ca42443d8101437ed666980bceb268396f4576123f7d844e473fcaeaa799fdfb84bf1619257bd982eafb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438763, "uuid": "ad74cecf-04a7-42d0-84da-a674c73d5f47", "value": "T16FC41C3DF1E98328A8611A20D7D19652063EFD8F2F5F226026DF29CED3B64409A53DD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438763, "uuid": "634af04b-2f91-4877-afcf-a1584b33ae62", "value": "12288:hTpiBHZNhjJk4caWHjOZ12CFJRdXPaRllxDir17yEwCRU1wkFkQdZ/+vRISRfA8H:GhCgEaogt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786438763, "uuid": "7a19d74f-e6e0-4115-b40b-8a85a20d011a", "value": 559222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786438763, "uuid": "d4a15982-98ff-418e-acdc-fc7f46260939", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438763, "uuid": "eeb943a7-ff20-4833-a186-61ab0a493929", "value": "PO -512609 WBN00001205195.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1aa09b5-95df-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786492314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786492314, "uuid": "ab0dd65f-bd07-4743-850a-b5bf3e59b23d", "comment": "Malware payload", "value": "d49014ac4d69a9430804c4a63c361cc1", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786492314, "uuid": "e6c50dbf-b317-4a95-95c0-a4febf83b51b", "comment": "Malware payload", "value": "99f690df427d7aa70db56419f2c602f3d2da22d387e3cb2668b002bb6380ced3", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786492314, "uuid": "1257e177-1327-4a18-b5af-c689a61be175", "comment": "Malware payload", "value": "5fd3e6e1ea1d668d771e2884452c538b2c1a0992", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786492314, "uuid": "a38a20b3-91c2-4b30-b509-ee8a2cb44c9c", "comment": "Malware payload", "value": "0bfee76d78f203ed986e3f9516ab227165bc5205bb39ee7ba0504caa4dec7cc86a609b132ba7872bbf3452dddd8a8eca", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786492314, "uuid": "f18f4b21-36fe-4956-b185-187e2cb9a0ec", "value": "T10F6733A5A05FB8FCFD2F87717846744C11B905ECA900D4314FBA05222DBBC6696EB92F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786492314, "uuid": "acc8f788-d1e9-4b9e-b432-1ddf8b4f7d0d", "value": "786432:XNZHVQ6v19c+JJHB7TyfOUbztWOMsNI/3hs:9zR9fJJhfqO0t0Z/Rs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786492314, "uuid": "96d8ef55-71a3-420e-965e-6cb4f6807d05", "value": 31371716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786492314, "uuid": "4d72371c-55a5-454f-b03b-2a36eea6d23c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786492314, "uuid": "7aafad5b-0551-4ac9-b707-df00ae9e2dcf", "value": "msvcp110_win.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91934aea-955b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786435594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786435594, "uuid": "40ac996f-814a-44d4-8336-936da62ec757", "comment": "Malware payload", "value": "75c0640f17e6bfa093f8799745a53b36", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786435594, "uuid": "b61e61f1-be68-443e-bb8b-add49e4ab981", "comment": "Malware payload", "value": "9a378ca20eb319d0e04702a9018eadaa9d814acee5184b192b32d5c00679ac86", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786435594, "uuid": "7a6e8a3b-ff97-42a2-b756-9141be94a8fd", "comment": "Malware payload", "value": "d0114c6f3db9e2480eda2e65c2a234eabe013706", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786435594, "uuid": "b56eae8c-ab63-4b49-bc5f-47643d30797f", "comment": "Malware payload", "value": "44b3e5726e026db5105e13ea1ab319c939edb7f1b75576a5a2ad28d09390ae698f20da40923ab5a08f79d6305be0a6e2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786435594, "uuid": "998347bd-61d5-458c-921d-08c16c595c3a", "value": "T105319CDE01506A314107CA9E73A2304C758EE9E7284FDBD4CD5E8EAA82987DCF352B49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786435594, "uuid": "9e4435a2-9311-42c2-9314-bc8fa2a5dd37", "value": "24:DpVcyD50EENFhU3rW+Mx8VWmcWtQK0AvbMma:AyVtENFG3rW+Mxw0+/Tu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786435594, "uuid": "c4380860-2ce0-4de2-aa92-97b67595c0c7", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786435594, "uuid": "f8f67d78-0dd3-4c3f-a683-b69f1bef0ba2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786435594, "uuid": "04810a82-2af5-444f-9f55-e094fc8c35e6", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61c853ef-952d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786415757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786415757, "uuid": "11fe62d0-fef5-4d1b-8a4a-114d51e65819", "comment": "Malware payload", "value": "30f8642ac869e38e9fa60a8967569c9a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786415757, "uuid": "c5fb344c-a8f1-4d17-9f9e-84472d948575", "comment": "Malware payload", "value": "9a747ead08a1556872ecd9ae256b2badf4ad56dc3c20c520e5fdb8d5557a5ab3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786415757, "uuid": "c185e455-28e9-4dda-a52d-ef35eb48d9c4", "comment": "Malware payload", "value": "1bd454da4bfffba10c6a2c8393051ba1d705f541", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786415757, "uuid": "47f1206d-745f-47fb-985e-2cba5e0e5b74", "comment": "Malware payload", "value": "c218231efb5ee0747215305e8f65fe5e388438392a83b320b17cf170b1c4130fb6bfab4010269a04a227ddfdf2af079a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786415757, "uuid": "e0c0694f-604c-48e0-9445-9b2df598d379", "value": "T1C3A3E70FBC5ACAA2CA929934C37F00512351874158BBAF736ABBD21DD76213BD7179C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786415757, "uuid": "85204d07-1a70-4525-b8b5-494cf18bbc6c", "value": "3072:mo8aI1K7Wm9HDA2zQaWnwbWAsd+YThDilAMjMw9croWB:momK7W0DApaWwbWAsd+OsA3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786415757, "uuid": "116472c8-7fe8-4a5c-a731-f49cb3fd3c8e", "value": 107180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786415757, "uuid": "d138bced-4016-4852-9457-c55acbb3c0cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786415757, "uuid": "2424a945-e754-45cc-9a01-5501a8ed09d4", "value": "main.microblazeel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7af01088-95a7-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1786468197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786468197, "uuid": "dc6d4194-0da8-4a3e-81d4-c9f2acacb3c4", "comment": "Malware payload (SalatStealer)", "value": "0cd76cc1b47c028c4cba9290157d645b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786468197, "uuid": "a3d61d52-5187-4aa5-89b9-4c6a57bcb4a1", "comment": "Malware payload (SalatStealer)", "value": "9b1bf0310a570af747639594a62e577e41ff7a41a7da8cc686b269c429e12534", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786468197, "uuid": "3b47c677-0d3d-4cd4-81af-cc81cb18fda5", "comment": "Malware payload (SalatStealer)", "value": "7cd96e6879603c88eaac2faf7332cf45fc5a4034", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786468197, "uuid": "75fe4416-a499-4e1e-9e0a-b1a86018d86f", "comment": "Malware payload (SalatStealer)", "value": "f032d394f3faebf4504e6eb0901a6551cfdf4f991e122562037eaa4dad1a07eef26fcac5aa80723466400400e718dc53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786468197, "uuid": "61067f9d-0635-44c0-b8ed-c36187eb6bbd", "value": "T1B8F533987FD1ACC3E48113B2967A7DC3AC99E54C0436A515892C327C05A2D6A38EF77F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786468197, "uuid": "d4bb6fac-895d-4c0d-aba2-2fc683d71855", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786468197, "uuid": "4ab04d42-1387-4cab-9ad3-d7ef59045dae", "value": "98304:gv5SSrrpetjZRH22BJih6AKovyBfElqIiepQaMPqB:gxSWeFrjFpovhXie6b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786468197, "uuid": "7a51775e-9c22-4b06-aaaf-103d9044620d", "value": 3593728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786468197, "uuid": "59784c2b-05d6-4fda-9dd5-062922cdf8de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786468197, "uuid": "c87ee1db-bdc6-4200-a686-a56d4e41acc4", "value": "Zapretnik.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6c81e28-95bc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786477371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477371, "uuid": "01132b0a-37eb-48b5-b74b-f1f9bd6baefd", "comment": "Malware payload", "value": "93b144b994479e86fef77a298100cdd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477371, "uuid": "3fafc468-a592-4b33-bc28-06a9fbaccea5", "comment": "Malware payload", "value": "9b68cdaa69df66527d44ee18c6a5085d0b794ea21c1814fd4c00cdafd51cd461", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477371, "uuid": "24f550d2-3987-427f-a929-6b25f4cde67f", "comment": "Malware payload", "value": "75c474a71ba9b4a5658c88752e72f401fef0a4cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786477371, "uuid": "b436a98b-f7b0-486b-8375-05a3d0fb9cf8", "comment": "Malware payload", "value": "26f264974f038652864c3e20489ab45157e6657e84e9c2d30660964d27b0b79f312af1821f80fce91f72b3f91c3d9380", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786477371, "uuid": "4fb83c5a-49cb-4808-b171-ec24d61539bf", "value": "T12C366B03EEA548F9D296D73588774242B764BC499B3533D32E60BA742F363D0AE79B40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786477371, "uuid": "a96f152f-fa92-4f71-8463-bd6100cb21d4", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786477371, "uuid": "1aa22fab-b69c-4731-8e83-4b0aa58cbd0b", "value": "49152:uFKpz7i7FAlc03DCBGcm+a1h6TczyJPj4RRHrYvAaaK:uc3XND1aJrCOkK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786477371, "uuid": "5068b033-101c-4743-92fe-37fceed65075", "value": 5002927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786477371, "uuid": "1d6b7154-e0a7-47b8-b7f5-fa8fea436a91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786477371, "uuid": "0bfc72fd-54ec-451f-beb0-c538574c650d", "value": "9b68cdaa69df66527d44ee18c6a5085d0b794ea21c1814fd4c00cdafd51cd461.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d85d81c-955e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786436741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436741, "uuid": "c38a584b-2132-44ce-958d-dbc4dbf9cada", "comment": "Malware payload", "value": "2a036580104185e9693c3a93f293c5ee", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436741, "uuid": "8c347dde-9ceb-428d-ba6b-8e24e45bd116", "comment": "Malware payload", "value": "9bac5c1ef6b9e38918d50faf152aafdade182e6c8fee3b52eb8c43ac9566fa51", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436741, "uuid": "90a41d15-f882-47d4-9b0f-8ea4c82a25b2", "comment": "Malware payload", "value": "a7f8653de129b6edc224c434b021a0c1b172e4e6", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786436741, "uuid": "cd332e91-8209-41a2-b680-e7fb980b504f", "comment": "Malware payload", "value": "5a95a9f09c725c54be0df94a0bc73c817429a8a5f09825d38c321540baa45d6ead6172a2189e09389b1cc8cda3b3b280", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436741, "uuid": "3f96eed0-fbbc-42a5-8b38-c9f762469e11", "value": "T18918230DD9CAB922E89374FE4397E98D562DCB7705AA4D077FA709802833BF4C678056", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436741, "uuid": "288799c0-c2c2-4f7f-bac2-865df465814f", "value": "1572864:bFxKCFxKFFxKOty6KVwHka1adryujG+AHb8VqJ4WY7rkd/5nP:bLKCLKFLKOty658VORP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786436741, "uuid": "1eeac7f7-68e5-43f0-b2e8-4937d242dcb0", "value": 88089849, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786436741, "uuid": "0691eaf4-e37b-48c6-aacd-0cece7fb10fe", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786436741, "uuid": "109748ad-fa0c-42f0-9cd9-9b25d0904e58", "value": "Extracted_Certificates 05.07.26 - Copy.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f16ec85-9592-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786459239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786459239, "uuid": "36438577-a83b-4a2a-99af-8d3f9f243f5f", "comment": "Malware payload (Mirai)", "value": "59f9043ea0265e2ef8f4bf090e0082a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786459239, "uuid": "a15d551f-1d6f-4575-8247-2d4591f44cfb", "comment": "Malware payload (Mirai)", "value": "9c269afc67460b28e47ac3e6f6484f9edad14c76cc39c00ccdfb009839a0bae6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786459239, "uuid": "0341fed3-5220-4dde-b0b4-c31686444d44", "comment": "Malware payload (Mirai)", "value": "a34bb339ecb5286ea35c888803d3bdd509d78073", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786459239, "uuid": "a6ad1c9b-71d2-4b6d-bb70-0c68f004bef7", "comment": "Malware payload (Mirai)", "value": "4da7c667154c685eb8bf8ec631396dbc6632434f87a17caabf880ea6e3d0280d2402bd30db71262b8de32b95d1cdcda7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786459239, "uuid": "5b698ddd-e92b-45f6-8fe3-d2c55e5e0b7a", "value": "T122D35B81F98B80F5D81B48716067F33FDB71D5284136DA1EEF648EB6CA37A42522639C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786459239, "uuid": "000b5d9e-9e32-4c5e-9086-3ee8830397ab", "value": "3072:NBzu6uQ7Y1++F4SjuKes4PPkiVZituCu:nzu6uQS+84ytg/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786459239, "uuid": "1b8673b9-7534-45e1-9b07-fce9a1fcc896", "value": 141256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786459239, "uuid": "2b06ac9f-2f18-41a7-b4d0-db34b602984d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786459239, "uuid": "322001e0-5fc3-4ae4-9faf-a809f5a6e0e0", "value": "sdfjgnjsdf.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac99470f-95c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786482025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786482025, "uuid": "0e0c7cce-15dd-4cff-9602-545753fc713f", "comment": "Malware payload (Vidar)", "value": "d1036630fc41ebc68659bb775a93206a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786482025, "uuid": "e7dc92e5-d336-424e-a8f0-fca518fd5710", "comment": "Malware payload (Vidar)", "value": "9c56c37f2756e500078c24bfe3a4e2d508c4b02bccb31382a690e7a5c36d121b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786482025, "uuid": "9cf9a139-7a84-4f43-948a-6397c41d83a3", "comment": "Malware payload (Vidar)", "value": "8f9191507d4690f15ba2471e51b766b356cef9d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786482025, "uuid": "fdc8f54d-5153-421f-9d12-5f5551c08278", "comment": "Malware payload (Vidar)", "value": "c8e01bfb52b6155c658a3b34ad54e200ce3d8eb8646c46d2a8d046626e44e5088d231ea67b29612de6bbbbcaf8b7992f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786482025, "uuid": "e79b3ba2-6804-490e-abed-cd11c68575bf", "value": "T1F5365A176E9148F6C0A9E735C4BB4259B674BC4D8B3523D32E616EB82F323C1AE76740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786482025, "uuid": "cd691672-cbb7-4c3d-bfe2-d25926d51b31", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786482025, "uuid": "f116773a-475f-4b7e-851d-88ca070695f2", "value": "49152:E6Laqa9JYpcBJT5xHlaEHrs/UEfLgTGGhkZJ3+0yOdImcVmANQ0ZH8Rok/t:EoOlHLc7TgTGGKZJO0yOdNchNQ4H8Rom", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786482025, "uuid": "4d4aa36e-1628-42b8-af95-ec3eca224bdb", "value": 4965744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786482025, "uuid": "99b298c7-931c-465a-ba5b-dd217d3eadf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786482025, "uuid": "5ae81bc4-1d70-48de-b462-347499bc5ff8", "value": "9c56c37f2756e500078c24bfe3a4e2d508c4b02bccb31382a690e7a5c36d121b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "565449ca-9591-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786458687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458687, "uuid": "f6964d7f-9486-4ff7-81ee-2cc658aad749", "comment": "Malware payload (Formbook)", "value": "b1872da5947fa72da354e187de33d1f7", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458687, "uuid": "73ead43f-0e7b-46d0-91de-e178378873cd", "comment": "Malware payload (Formbook)", "value": "9ca5f5aa2a2f99dc20635e697916aa357d72d584a754b346e034acb6a04f12ca", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458687, "uuid": "fd1df08d-0105-4211-8aa9-ef2a38931c4c", "comment": "Malware payload (Formbook)", "value": "fef1d06b49ef721eea60e0ddfa453d80ca1310f5", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458687, "uuid": "ce9b4727-aee6-4130-a3d9-f81ad28f1033", "comment": "Malware payload (Formbook)", "value": "2d2805c3d878bad5897c73ffd9617df744f5d928290532c534d651daf3457c4c2ac76b1fe4c418af2e5dee625af00b1e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458687, "uuid": "5b2f9bdc-bc33-4ad2-91b3-a65425f6294f", "value": "T1693552F2E7A20C16F7600887EF5237D1F20147870520B5A7BF19A56AB4C259F0AE5E7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458687, "uuid": "31cd8637-1fa9-4576-ba12-7d3cc40f0bef", "value": "768:ZMtaqbkTF/AzzCLFFpFs4aFyWv/zDPKFFF9CFeFovFPFFlaDCeN3+DZTEzFUFl66:i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786458687, "uuid": "110db22b-4102-4f1c-b5e8-a4e4867a595e", "value": 1084226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786458687, "uuid": "6fea8309-76b6-4e1b-8cb0-c76e44ac7cf0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458687, "uuid": "97a5727b-1dea-4757-860a-c0504cd90be7", "value": "QtePage2.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1e87f34-95dd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786491536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786491536, "uuid": "9129bcaa-ef71-4520-9f8a-fecd2edbcb59", "comment": "Malware payload", "value": "2dde0c9b6c11bec147a0bd17de3a8b55", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786491536, "uuid": "ba014b1d-008e-4572-8061-6a5966024c61", "comment": "Malware payload", "value": "9ce5370660954da519f862e04d5685f4c5b48624184c592170ccf7511ffd391b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786491536, "uuid": "0d951a91-1dc6-40d1-90ad-d124f348e21b", "comment": "Malware payload", "value": "5b176e7339bb432ccc0698afbd617af438c293ac", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786491536, "uuid": "4267125f-d37e-4101-84f4-24510b3ade72", "comment": "Malware payload", "value": "491e142f6976048e5728869cbc83eac72a36648313f9c24b6f8208621181c30e53fd769c19a259caafee306f53007326", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786491536, "uuid": "21daa05f-0628-406b-aa3c-540c111de7aa", "value": "T1E2E6339ECBC98649C03760760656DED3F79BB421C2E9F9CA12B44987E5009FE222537F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786491536, "uuid": "a75b48f2-b654-4f19-bd08-7ada922d7df5", "value": "393216:EWrVofC7uFUpWWUw4vBq4xVDFWrxeoXMkcpUZDVdx:EWOLFUyJqyV5WxUUZDPx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786491536, "uuid": "7c9a91cd-603e-4309-8d2b-0c6a3856c2b6", "value": 15025856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786491536, "uuid": "40f3f14e-6e6e-48a2-b10e-fe77cfbd02b7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786491536, "uuid": "dd90d970-a632-4e16-aea3-80dc4b74a681", "value": "GPCSEWrapperCsp.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78f4c2f8-9579-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786448437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448437, "uuid": "e4691aa6-a82f-4291-888d-bd1b20cc5e37", "comment": "Malware payload (Vidar)", "value": "70ab723d1b9b0ab704dfd9c891dcd270", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448437, "uuid": "558cfa76-2c1c-4515-9eb5-80413340376b", "comment": "Malware payload (Vidar)", "value": "9d53f499b024885aac98733a79cd09f4165e372402fb8e9519561f006c705a36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448437, "uuid": "6a6c3308-007f-483e-9e5c-ba90d28fd5a5", "comment": "Malware payload (Vidar)", "value": "a729ecbe90fb732d822980f22875b06e5db82a61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448437, "uuid": "9ce69272-8e92-4122-98a8-8c03a1a5bf5f", "comment": "Malware payload (Vidar)", "value": "97858b3fb34e43ef73797d62b4786366adca33c82ea79a877a159156cd4c382984c83181e2d6de1939e724830bb07844", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448437, "uuid": "2979b71b-f330-4ad5-bf9c-b608f176315e", "value": "T170167D07B89048BEC06AB63085E776563B7C7C480B2163D72F60BA393E76BD1AD79744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448437, "uuid": "98eddbab-d498-4574-ac3a-fd3c5b2dcd45", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448437, "uuid": "d47567ed-8eca-4555-a713-747c46f4353b", "value": "98304:9GuuFqbaswVXSLxzbb6Q9b7PU7V+vSDuZCEQZJvEiCfT:9gFqbYVXSlzbb6Q9b7PU7V+vSDuZCEQE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786448437, "uuid": "84a80653-29df-47df-8d85-1cd772dadd19", "value": 4283328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786448437, "uuid": "245b7792-efd8-4974-8015-93ccbdad2751", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448437, "uuid": "0fc27764-5d07-4341-8be1-102b8492d327", "value": "9d53f499b024885aac98733a79cd09f4165e372402fb8e9519561f006c705a36.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a190fba-9526-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786412684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786412684, "uuid": "b1e34f0d-ff23-4248-8ef4-344b5bf24474", "comment": "Malware payload", "value": "af045fce3ce3ddb83562ce2ffcba3928", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786412684, "uuid": "5fca4b23-1405-41f0-8b94-76ae70db9d8a", "comment": "Malware payload", "value": "9d9f0d3402bbd8a90760c9615305249a3f6f55dcdaea21a41014da22b9227bc7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786412684, "uuid": "2d5ce3cc-4c82-4cec-ae8c-c7cffe471a96", "comment": "Malware payload", "value": "b8f81d3df9d190792fc1d4a87e809b9d7182ba11", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786412684, "uuid": "5a74b2ad-5fb3-4fc2-b7fc-9c8c240cd285", "comment": "Malware payload", "value": "6fd2c859ecbbdcfecd6476b369a0900ec520006eb791f7fdfdfa77ea6fef59e3a75586d8225a56ce4d16f30ff77e4955", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786412684, "uuid": "6432831d-fbb0-4b8b-8f55-7f8f7ec9cf29", "value": "T1ADD318137A271D22F4D11135A2BF03E2BFE683CB35784E97B65109D9AF276A074832B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786412684, "uuid": "e1ab9d01-b3c3-4187-9e29-56c27186ca3b", "value": "1536:mv18eDS/9rNjRLRBugU/nf8bWpnmhytMQfI+n5p5L1lPu:41TwRblBJU/EbtLWpu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786412684, "uuid": "e76bcb01-c478-4327-98e1-bd83a540c7d7", "value": 132480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786412684, "uuid": "694963db-5888-4754-91d9-f241436436a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786412684, "uuid": "16240fb1-7a22-4078-85ae-732e099a6bc5", "value": "main.sparcv8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae8920bd-956b-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786442514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442514, "uuid": "07bcd37a-e6a5-4f34-83be-0be458b906ab", "comment": "Malware payload (RemcosRAT)", "value": "d3d20ea44a10e83161c53c2db79f2ea4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442514, "uuid": "6401fe61-6f9a-4ac6-91a4-c84d1c2e79f1", "comment": "Malware payload (RemcosRAT)", "value": "9dadc0f51d3993652b7f6194eea07d28d3c6b6eedc59aef227f4fff124a4747a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442514, "uuid": "7bc88cf7-be2d-44fc-a749-ffae0e911348", "comment": "Malware payload (RemcosRAT)", "value": "66d65cf1ed667ded4bc1806ff22ce1f24be482ba", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786442514, "uuid": "45e241fe-72e4-4bd0-8b1b-90db80cb5c74", "comment": "Malware payload (RemcosRAT)", "value": "802307e661bed6dc9dd945a48d6ab6016bdbd44b695311bf72195c6a583645a9240ed68593794d0937537ac80379d572", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786442514, "uuid": "68471e6e-a424-45ef-9ab0-628e73f74672", "value": "T12CC4401D556EE01A60616C60D784A8E2636F9D8F8F5F009B154F88FCBB8B22405A7FFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786442514, "uuid": "31f3941d-5ed3-4deb-9145-adacd6da9138", "value": "12288:T7/qOxcO7SdhxQwS9FpL4waV1g+NVDzC7uMcTyxrXugmedHQh1JAdDl3Ep75l9Yd:T7/qgcESdhxFS9F6w+3Oz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786442514, "uuid": "dee47354-0d86-4e87-ae7b-eb929edc7a64", "value": 551354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786442514, "uuid": "936dbd47-a669-469d-9dd7-182be800bf63", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786442514, "uuid": "9c074cbf-8595-4361-8c0d-c79a62eaffef", "value": "USD 42,480,25 Payment Receipt & SOA.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "134910e1-95bb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786476614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476614, "uuid": "a218bbaf-e0c8-433a-989d-34eae4fd52e7", "comment": "Malware payload", "value": "5a6855d1bbf69a5160178893a32d3605", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476614, "uuid": "b050d85b-2d39-4062-b60c-4740f6ad45b3", "comment": "Malware payload", "value": "9db06ac6649b33c974831283c3223461c358c5ac5af4a19ac6650f34d522b00f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476614, "uuid": "605ed7f3-fd9b-4e86-857e-07a197d44549", "comment": "Malware payload", "value": "3b064d5274502f9289f9547bab7676b9c7c3cfd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476614, "uuid": "b94d3c0c-79d4-47e6-a2d0-9fb9baf1f5fc", "comment": "Malware payload", "value": "8b1850fdcb8d0847a319da4b3e51afbfaf45a1e60f057591649855df2489e8ae24dc2bbf2f4a192114dc2187a56f4cc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476614, "uuid": "666c8a2c-df89-4414-82f1-83e66ac77d64", "value": "T1B2366B03EEA548F9D296D73588774242B764BC499B3533D32E60BA742F363D0AE79B40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476614, "uuid": "d7f47f09-4d43-42dd-8c08-068fc71bade0", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476614, "uuid": "6cbe1930-b639-481a-a975-a00fe1eff36b", "value": "49152:uFKpz7i7FAlc03DCBGcm+a1h6TczyJPj4RRHrYvAaaw:uc3XND1aJrCOkw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786476614, "uuid": "6a7a3a91-3cd0-4b15-86ba-1625005ea517", "value": 5004027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786476614, "uuid": "efdacfa7-3d33-477a-9985-ca7f2d6dcc7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476614, "uuid": "b1c8053c-e1c6-4255-b4e5-2ba1167f799b", "value": "9db06ac6649b33c974831283c3223461c358c5ac5af4a19ac6650f34d522b00f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f157dab2-95ba-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786476557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476557, "uuid": "3b890811-b91d-4417-84a8-0eb1eae348c7", "comment": "Malware payload", "value": "f7dac7931d8d203e9877b45fbca055a3", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "unattributed", "colour": "#1869C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476557, "uuid": "635ba37e-c807-484d-88f8-aebf6774493d", "comment": "Malware payload", "value": "9dcf4113c39cf135f32c902616d5142b69c8644cff82f476266562665bc42a7d", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "unattributed", "colour": "#1869C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476557, "uuid": "05b0fe76-cf63-48fa-a48a-633ea0700200", "comment": "Malware payload", "value": "fcceba55662d4f75e392278358d1016aceb8dffd", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "unattributed", "colour": "#1869C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476557, "uuid": "ba1c16eb-9182-423f-b8b4-d4a1930601f3", "comment": "Malware payload", "value": "fecc332226c871ce083d1754be9d69f640063f8d82f50b89d59b34ce4a175d485d42b08d86140d8a944c972462577e80", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "unattributed", "colour": "#1869C5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476557, "uuid": "13456674-ff2a-425a-8796-bdbf109e3848", "value": "T126B66B113B95C42AF9B6117C6D39AF48056DFE22177050DB938436AE0F32AE36A3935F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476557, "uuid": "88734b74-6a0a-42ac-b3ab-602275e5798b", "value": "2c0ee08cba66b618a5c40e0b93e5218e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476557, "uuid": "fad9c6a1-0bbf-4089-9293-4d140ed8cc95", "value": "196608:J1Qyev6IOB+1vL2FsnbfaR9bKv1lOYggj:J1Qyev6IU+l2Fl9bKv1lOYgY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786476557, "uuid": "5d4e0077-581b-490a-b7e1-944099df19ea", "value": 10646120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786476557, "uuid": "3f9dab75-f592-4079-a6cb-8024888c9a96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476557, "uuid": "da42a006-1132-4e0f-9609-c5b9f8cab9cc", "value": "9dcf4113c39cf135f32c902616d5142b69c8644cff82f476266562665bc42a7d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9992a9e9-95bb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786476839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476839, "uuid": "16804c7e-5f94-45a8-b8fd-374e192bed29", "comment": "Malware payload", "value": "7e7d1e46f58c68357189bde47b32433d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476839, "uuid": "8d6393e2-7bcf-481f-b1fb-8cdb8a5e5426", "comment": "Malware payload", "value": "9e0e5da3c63f565cdf536954a8a56dfe3f7adc827e3ada606147915b78cbd328", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476839, "uuid": "621bd777-4020-4d4d-8e6a-5e3bdd2744a9", "comment": "Malware payload", "value": "5045a7054b61be2cda763fb6e041077f391b2cf3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476839, "uuid": "55dc7905-d18e-40c7-bc40-5b9cb1008439", "comment": "Malware payload", "value": "56f734caa37bbe6397f4bed477a3b0ad8fe1c96bba043d4ece75ad6f51ea471bb5f09a1f679c33788b3920ee1ac0014a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476839, "uuid": "5564c469-afb0-42f6-80df-0ed8b541b209", "value": "T1B643D549FA41AB05D5D231FAFB8E414E33176FA8E7F93121D9305FA023C6ADA0B76521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476839, "uuid": "ef86f6cd-d43a-4b05-9c42-582cfd5a5b18", "value": "1536:nwnhzCdiP5W2aMhtIhyUA0AEPmlqy/bi/hxoRFnSEuD:azCd2aMhtIhyUk5uhxo3/uD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786476839, "uuid": "5f6d8916-299e-409d-a749-e61745d73cf5", "value": 58496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786476839, "uuid": "5f05ea50-f59d-4123-ae69-a746953c10bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476839, "uuid": "7fbbb1a0-23cc-4e9a-9afd-8f339d817581", "value": "main.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cc99050-958c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786456577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456577, "uuid": "c899e5dc-f880-43fc-b9be-01e8fc5bfac8", "comment": "Malware payload", "value": "379b0589de457c565a416a18ac5a955e", "object_relation": "md5", "Tag": [ { "name": "BypassUAC", "colour": "#E8D0B0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456577, "uuid": "c2be2ef2-9d5d-438f-9659-080161af3e82", "comment": "Malware payload", "value": "9e2e4cf6c89fd65856d9ec71438ada4202ca6cafda0030a5b5db3708f962f42e", "object_relation": "sha256", "Tag": [ { "name": "BypassUAC", "colour": "#E8D0B0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456577, "uuid": "9aac10f8-7da7-4480-aca5-7ec217345b46", "comment": "Malware payload", "value": "52cd89f48c1feb5e50ec628c152567ab9253ee67", "object_relation": "sha1", "Tag": [ { "name": "BypassUAC", "colour": "#E8D0B0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456577, "uuid": "ee3fe08f-ee97-48ee-8057-9d7c11b5967e", "comment": "Malware payload", "value": "7e3f9408f56f1594b9ccc45a6dde58989cb866f14c603281bc827a2a7cd1df407942dfda5b74195fa8ef426670367c0a", "object_relation": "sha3-384", "Tag": [ { "name": "BypassUAC", "colour": "#E8D0B0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786456577, "uuid": "97b84bea-8694-42de-8bf4-ed076e52fbbd", "value": "T147442B1B73931CF8C55B903546E7E772A532F8150329AE6E0AA4C7333E65E640F6AD38", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786456577, "uuid": "42fe81ae-9d18-44fd-8c65-46855a4f7d12", "value": "34e5b1a9b3d8d54c0d067ce2d5b1237a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786456577, "uuid": "a99a4e07-934a-454e-a867-77ad1d95ebd6", "value": "6144:6wOenscmT/3iuxIMfrLKGs/ac4OY9OVc7Um1aiUNvBoE5n:BsBSuxIMfrLKGs/a3OVc7UvNBD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786456577, "uuid": "c812d0c3-38c9-4e98-b3f5-4fa1d2b84bf6", "value": 260096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786456577, "uuid": "c715c625-e7ff-4c30-ba82-724a6207f1e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786456577, "uuid": "7559be08-1dcd-47e3-ab19-2298503ec0ff", "value": "Bomb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fad39681-95a1-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1786465835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786465835, "uuid": "1e085ade-4aee-4e79-aed4-38d03664e744", "comment": "Malware payload (SalatStealer)", "value": "814de9aac379156fa5a64dc4c49e8f67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786465835, "uuid": "4f53c049-1e80-4c41-b2c8-9ed6e8d60033", "comment": "Malware payload (SalatStealer)", "value": "9e35060a08af71f28e18c7226867115ff72a3ee52333ce4e9fd65c21821e7bbe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786465835, "uuid": "af975752-993b-45da-9dc3-ef4c3801941b", "comment": "Malware payload (SalatStealer)", "value": "863a3c331c436af7b84349d5ebf9fbc2c37e172a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786465835, "uuid": "80b4f5b0-e203-4e35-a916-6059718398f2", "comment": "Malware payload (SalatStealer)", "value": "540b5cdf079255ee9b2346c1436dda1887b89c034f0892b59d7967dbeedb7a60d0104497ebb3ddab12b43d8761ea870b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786465835, "uuid": "cab34bf4-4440-46e1-9e3e-dbd542eb2669", "value": "T1B4564913EC9955E5C0AED13089669513BB71BC880B2123D72B90F6387FB7BE0ADB9750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786465835, "uuid": "5bd7a1c0-d28e-4bd9-a0df-4dce9ba90bf6", "value": "4e2bd2c481372f7ab13b83b63b424e97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786465835, "uuid": "50e971f0-4841-4095-b039-ddc213bb17f1", "value": "49152:yVnB7YdmZylciXG6z7GQ5lxSN380UZQhPFF5ZfwUajb+h0XKYzUnzJ0KQK1K65Cj:yVBeWE5NMFYoX/5vt1E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786465835, "uuid": "4b992c65-b1d2-45e2-b77f-2ccb47473e49", "value": 6210048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786465835, "uuid": "0dd2a277-e27f-4fd5-b638-44cc3f7f63c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786465835, "uuid": "44dbc33a-a7a6-44b6-b338-e78e17837615", "value": "StartWin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4c89805-9562-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786438767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438767, "uuid": "58929b3f-c8e2-4c17-9e56-1fad9a133e81", "comment": "Malware payload (AgentTesla)", "value": "ec92fdd47b01959935b5fe8a03573e05", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438767, "uuid": "1f4408bf-c05e-4603-9aec-d63adb41a91c", "comment": "Malware payload (AgentTesla)", "value": "9e567884cc3a602af0604bf762be9b6c3849dc49678b4126012a371130a73cd0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438767, "uuid": "27108572-547e-493d-a47f-3bbd979c5fe5", "comment": "Malware payload (AgentTesla)", "value": "d9825bcdc05918023b2e3b01b57eab3c39f3cd60", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438767, "uuid": "aaa1f70c-27e6-4fa3-9a24-3562863e8a05", "comment": "Malware payload (AgentTesla)", "value": "529f65620491e1319924cc4e498131fc7df1c977802fcc928c7683603b11a8a90e8a683dd0500b3a4c7157ba3405869e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438767, "uuid": "4d5bafe4-ed09-4df8-9d07-52eaec231fa1", "value": "T152D26D6433A6D116E048DAB14FE4E5DB5B21FCA1AD539B0B32C0B31F197AAD0C417B2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438767, "uuid": "8701e762-fcdb-4b32-b3eb-97d6216f2d79", "value": "384:s+ilKNDbVhPZ1vekIbrpU+dP9q7GllRIdA8tD2ZFf48NWKEyo0en/fENX:ssHPZ12k21rRIdA892rfjlYT/fEB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786438767, "uuid": "5fe8ff2e-45cc-43ba-b73d-0aa2bbc6eb82", "value": 28672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786438767, "uuid": "112aac9d-52e6-4a64-922e-4f5814873bb6", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438767, "uuid": "73cf0565-ca4c-4ff1-ab13-35f07bb484d3", "value": "orden-89798.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36ba8f1d-959e-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1786464218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786464218, "uuid": "c816a775-52ae-4ae9-bc93-1c398b457f3a", "comment": "Malware payload (CoinMiner)", "value": "6ecb74dedda13195d3831d73094994a3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786464218, "uuid": "b515a94d-fc9f-404f-ab3f-d853bbb77910", "comment": "Malware payload (CoinMiner)", "value": "9e89e810b67b4051d976807c0d22ac7d59fb842d4625bd63e45133dd212fde45", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786464218, "uuid": "4cefc9c2-ce52-409d-bd9e-fcc35040d055", "comment": "Malware payload (CoinMiner)", "value": "41c3613aad9da70b077a0486c7a664ea2ec15d2d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786464218, "uuid": "d923af78-f41b-4289-b894-7083b7b69b98", "comment": "Malware payload (CoinMiner)", "value": "1a5d3015fa104ae6f91a2d4724ab866d176f39d957e570d453b215359c0e21b1b8f0a850166fdb2e7b8cf39aa8cda49a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786464218, "uuid": "756baee3-0c41-4ddd-a6e1-9a411cde6157", "value": "T1F731C0915762ADB62CD8C26CB1EA84E96043123F095F2F58F8DAFDB65F4C580F264B70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786464218, "uuid": "1f6e2ee3-aef5-4f84-a7db-f7b962889f10", "value": "48:VUeYj+H1JjDMK9CnYhEkDw1J8PGeMeuiJ8wOjSu:Ge6cmOHui7A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786464218, "uuid": "a1a04910-c2ab-4a1e-adc4-f6073766acc6", "value": 1628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786464218, "uuid": "bd3b8e19-5beb-41d2-b298-70a14dfa9223", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786464218, "uuid": "640233d7-9966-4f2e-9adc-c94c12890dc0", "value": "check1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b763ba8d-9561-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786438234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438234, "uuid": "7fb66ae4-b745-4131-840c-e1325d062c54", "comment": "Malware payload (Formbook)", "value": "f63916c0e46d0ec8585a6eb57af761d8", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438234, "uuid": "e0fec555-6b61-47d8-9e15-52b62842a3c5", "comment": "Malware payload (Formbook)", "value": "9e90cc3386c57560538b3732e564d4e8bd1f2ac8961bc9c069b07a4154cd04c0", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438234, "uuid": "0986975f-000b-4c9a-9de6-aeb67a7b59a6", "comment": "Malware payload (Formbook)", "value": "7693335d27ab89daf95946ba39a4b7b222cd7d13", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438234, "uuid": "69db4683-7b98-49e3-a857-7d2e4ce51673", "comment": "Malware payload (Formbook)", "value": "3e302033579e3b01c268e638bf254c168a4ccdef75a5e6afbf1a109d04f87ac256106d78726a63f6792355e863ba5ef2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438234, "uuid": "dc4bbf21-4b78-4db0-9f46-2c0b05dac9b6", "value": "T1CB158E9A1822E4644EB8FBB1077FB52B94D137FC3210658F74945F862AEB9D1B102FD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438234, "uuid": "11b2a2c1-2cd4-4454-b92e-f50fd6df2e39", "value": "24576:uA27m/tHivOVu3zrPFdotylRPNGL5NToTQb7y9:uA27m/tHivOVkzrPbotmRPNGL5NTL7O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786438234, "uuid": "6d71347f-8fa7-49e9-9653-2856f9af6121", "value": 951739, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786438234, "uuid": "015dd5f9-a14a-4053-9354-16f5ba93bc9f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438234, "uuid": "d9c46b8e-8d71-4579-8ecd-dde06f74e777", "value": "COTI_384526.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8e0419c-9595-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786460624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786460624, "uuid": "8a1ca518-0cdd-4c3c-82ea-5d3e9515990d", "comment": "Malware payload (Mirai)", "value": "e35b7d656973332ed2b2b3d270c27eb5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786460624, "uuid": "f0a6d841-2bfe-4bf3-9882-73cd16ba6f59", "comment": "Malware payload (Mirai)", "value": "9ed79240bf9bfdc58e8b4a705ff1eba11fbdda327d66e32b8d5d449b7a38a1f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786460624, "uuid": "c284ee3c-f46a-4e35-8c16-87858d2ac18e", "comment": "Malware payload (Mirai)", "value": "a029098f78e33511dccb443390c9aeab8134b575", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786460624, "uuid": "d7fad2e1-fa1a-4314-ba0e-2253d542b4bd", "comment": "Malware payload (Mirai)", "value": "ad4a758ed7dc80bf84cc2bf3625850b6cd34f426f0c6e167983c736c9225f4cad65274e2aefe5d3f79f7eec1e702c3db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786460624, "uuid": "064c1298-091e-434a-9b58-79120025a3aa", "value": "T1DEE32806B31C0903D1A32EB0363F3BE1A7AFDAC222E4F201255F569991B2D775946EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786460624, "uuid": "bff19434-9eb0-4dab-8495-a0a3f2a483b0", "value": "1536:67RfDIqswvZl33CuD+gxo/SoSu1VLXB3nATyqR2ovAwY6rSYqHhjqprqjGO0v3yK:Ofkq1v3D+gxtoSsiTfRKwR+GWlIR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786460624, "uuid": "380dfbed-8b73-43fe-a69f-fa7031ff3ca7", "value": 154680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786460624, "uuid": "5357e5ac-17a5-43b7-a0e6-d5366e9cbe9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786460624, "uuid": "da17dee7-317f-4933-8666-07bd34197ad5", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5f98276-9587-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786454553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786454553, "uuid": "2e75d312-5ba1-4135-bc13-f0d497fca733", "comment": "Malware payload (Mirai)", "value": "bff0823e6d13adf06f211dafbd794f38", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786454553, "uuid": "f0c54dcc-1b75-4423-8344-d3a44654beed", "comment": "Malware payload (Mirai)", "value": "9fe66e79d0915b66e8b6eb02cb7de92815220955deaeb135a677bdb4239d3ce2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786454553, "uuid": "cd85842f-9e6d-4c60-8fec-dbcf5ff54397", "comment": "Malware payload (Mirai)", "value": "d9477bc175daeda3498bc07c13cecedc93c8cfd5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786454553, "uuid": "494b4683-ccc5-4c66-8863-ada946e89502", "comment": "Malware payload (Mirai)", "value": "9ba6989172aca0ff773abbdc4eebf6879c9479b844ce655a9c932a4c46af0d6e19fea81761ea84d0f5319e8b4e136c6f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786454553, "uuid": "dd255f83-4d09-4168-9355-bbab93768884", "value": "T140144AC3F900D9BDF80AE33784134916B130B7A214926B37B257797BED3A1990577E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786454553, "uuid": "46905294-fdd6-4fa6-b4be-e41ba8574963", "value": "3072:jM2xzwEkB6mnDbVXl89xcQF23a8WZoAuG/nf1Vpjbi1LxKQIyV3H+9u:w2xz/kB3n0oQF23pWAinfgLxKyVEu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786454553, "uuid": "d8490de1-2772-4556-82f1-aca1f10da28f", "value": 191072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786454553, "uuid": "7fb5398c-56ff-40b6-b578-c5e7be9b0ccf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786454553, "uuid": "e580ab25-f4ac-4607-abc2-e589f8a975ac", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62131212-9562-11f1-bd95-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1786438520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438520, "uuid": "0046fa9c-abcc-43ac-b8ca-95545e7fc563", "comment": "Malware payload (MassLogger)", "value": "32639283c1fc848d937f35e95d087435", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438520, "uuid": "e5473a85-cc62-450e-9988-264bec86f7f6", "comment": "Malware payload (MassLogger)", "value": "9ffb04a069e24a1e9f36677a8aba3185e0ddee9a9d0a699b2f88c0511a1a35d8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438520, "uuid": "b15aebb9-35f9-46e9-bb60-cc31085fad7c", "comment": "Malware payload (MassLogger)", "value": "dd0b03f5fd4f73fdb8291647fd999448cca6a82c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438520, "uuid": "3529fc07-7916-458c-bfc5-1052d16a4a67", "comment": "Malware payload (MassLogger)", "value": "51d34dae388cd2058cfd889ade0bd520ab964e3574fdc4c49bceeedf52bced8a2a69764f07acb07285be2b0ccff64da8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438520, "uuid": "334674d2-bf2b-4ab2-9f7a-5cb105783b06", "value": "T109760AF131DEAA0B1D193355D49D2E805F0FE52416C3B7E8B0DB6AF1610FE4A2990B9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438520, "uuid": "3e9b6241-d4c2-43b8-babd-d30d1ae5881f", "value": "49152:mAx33+hANrOhniKAEB1TyO24JqrbwpPxX9zKZL2R2gScgfkK2UBE/0n2oJFtd1De:y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786438520, "uuid": "db34713f-6567-4567-a781-9e393f2fc3ad", "value": 7223476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786438520, "uuid": "69bb89c8-41cb-43d4-b555-9a80f526d944", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438520, "uuid": "990e335d-6d0f-47be-bd1a-1cab02e3c0c1", "value": "Purchase Order ME83E0340372.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e083d0c2-958e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786457630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457630, "uuid": "970830db-00a4-4833-8b5e-8f683490cff2", "comment": "Malware payload", "value": "b5ced22cfcf0c0944e92e48125cd5ce7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457630, "uuid": "77c56a3e-3660-468e-aa0b-b3d9f2bec89d", "comment": "Malware payload", "value": "a047e49af4564b60d0001deb7fff11c504d5a52dde8e316352166ee2673cc836", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457630, "uuid": "1e94f899-21ea-4ae9-bf61-2cf0022864d2", "comment": "Malware payload", "value": "e3b3ba8773ee7e1a14d357e7274415fc82dcbc2c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457630, "uuid": "caa7e89e-77bf-4496-935f-f6841deb0bb9", "comment": "Malware payload", "value": "aaf05e8488924d7daa439846efa86b10ab9df2aba3530538e2babfab7c09285a002d326e03c5e1b3f96778c2ba74e0b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457630, "uuid": "5b58a918-9136-4400-814f-0575b62f0e20", "value": "T11EE2C502AA53C472C90321B152F3DB624930FD77BB24950AC769AFF2AAD51C0E25337E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457630, "uuid": "901f51d6-e550-4f30-b51d-c651beed7ce0", "value": "384:fdqHdiw0jL9KrulJQfFRvoNq4RbSZomJ1i8jlB643Ll8QO1Ei4TYIIUWr4dU:Gdiw0jLvQFRvoNqgMomDFdNzPIU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786457630, "uuid": "6b6393f0-a6a0-43ca-94d0-5adff9beb230", "value": 32284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786457630, "uuid": "07b430ff-56b1-40f8-bc1c-5ba1033d2480", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457630, "uuid": "ef94a151-4848-4662-938a-d9555f0a0352", "value": "main.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b32da74-95a7-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1786468252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786468252, "uuid": "18ed568e-9533-4547-aff5-a461784fd705", "comment": "Malware payload (SalatStealer)", "value": "e13c65c8db36eb6ddd548787b140fe53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786468252, "uuid": "a6d776cb-ec42-468c-9ce1-70ebb16ed24a", "comment": "Malware payload (SalatStealer)", "value": "a0a7e353ad72c45c4652931e21b805c99e3e6a36a03d6b8495a8668c5068e594", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786468252, "uuid": "f47c62e6-ec42-4813-9aaf-d79ecb8d5ede", "comment": "Malware payload (SalatStealer)", "value": "50a2252de46e94057c53a39e702e0d6cb44c0bf9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786468252, "uuid": "57ecaba4-4773-4b2e-92ab-34c10411ef6c", "comment": "Malware payload (SalatStealer)", "value": "42a9e4970ce2b7a065d701aa51417f4b4868d4d7aa30d6777de8d7e79b3d3b9eb2db75462a11c7513e883875275b78bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786468252, "uuid": "ba3163f4-3c49-40a4-9862-6a623d2d3ccc", "value": "T16CC66C11FACB54F5F903583140ABB37F23315D048B28DB9BEB183B6AF8776A1196A705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786468252, "uuid": "62e5ecce-2f3d-4595-9c96-0b9c0252a1f6", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786468252, "uuid": "91ad8cc2-d169-4530-bcaf-be1f4f621a9d", "value": "98304:fU0yb/iLuZ6LiNtq8I9ql7wMm4S3HVdTEqO/:yiDstY+BmT+qO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786468252, "uuid": "1c368367-bd04-49ef-977f-fbebf8461ed7", "value": 12571648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786468252, "uuid": "a16a7065-254e-4e16-b971-656e48ab566d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786468252, "uuid": "0cf1e1a9-cbaf-473b-a87e-4d0a58f40bfc", "value": "Zapretnik.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de8d678d-9549-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786427992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786427992, "uuid": "c954de16-6c77-48d6-80bd-a7c99eddb48f", "comment": "Malware payload (Mirai)", "value": "b197c852413f03e75da4946413b2ad32", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786427992, "uuid": "e70c1ce0-6613-4b63-96cd-2147d642355a", "comment": "Malware payload (Mirai)", "value": "a0acd0568ee8394a8dfb4794b24cbf64579ba48ca5ac4749f5ff82783998bfc8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786427992, "uuid": "97de1418-3b5f-4755-b51b-bbb9fc4dafcd", "comment": "Malware payload (Mirai)", "value": "e724165c08425159fa0f16041474b68cb57ef589", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786427992, "uuid": "3f0acf48-85ca-4b33-84f9-bfe22f7956b0", "comment": "Malware payload (Mirai)", "value": "046f65835716f8ac67f587b313027e2e209971f3ab5303ef8d9b8ae68d6e0aad2655ab9a46b7c22b58b60ddffe5cad73", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786427992, "uuid": "abdedf95-523d-4399-8ff8-b85dd8eb01dd", "value": "T10B04294F7710CF61C72DC93049B38B5666E526512AE2C889F36CDE08BE6434DA86FED4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786427992, "uuid": "60d4875b-38f8-4b65-92eb-6969d46a9e9b", "value": "3072:e+SUpNQmNIk7dplyZGxEnxb18soJ5QgAdRDgWEAA2241DWjh:1bSxbCSXDxtF2ugh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786427992, "uuid": "5c97e0a4-d290-4bc1-8182-69c42171c2ae", "value": 185380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786427992, "uuid": "ffbbbbe6-51c5-46b6-b1b0-492af49bb6fb", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786427992, "uuid": "8f0cb10c-76f8-408f-92e0-b92917ac4a5c", "value": "putita.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8560381-9581-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786452060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786452060, "uuid": "42fe28f2-b4bb-47be-98e0-1de272a57a13", "comment": "Malware payload (AgentTesla)", "value": "8b57c9325167079d0c1c0e03293a503b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786452060, "uuid": "7765dda9-818b-4bca-98d7-0229a8e5c691", "comment": "Malware payload (AgentTesla)", "value": "a0e4e47b1aca6c4d0e84ac1f2ac881a22a6470a88c270cf78052b78dfc75880d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786452060, "uuid": "dc695102-ac13-4f49-bb47-a2672ca42332", "comment": "Malware payload (AgentTesla)", "value": "b610d091ead7a7b8389edc2cb89d42c455f6cc2c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786452060, "uuid": "866fc5a3-8c26-499e-95b6-cf2633bc0355", "comment": "Malware payload (AgentTesla)", "value": "0d069fae2636e38ee6ae458a215835bef7737286d3b644f72082b2ee69040c5c3989a42207731166e96fbd4d406356bf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786452060, "uuid": "11df1a76-7a24-49d1-b834-e85cd703227a", "value": "T1806533787BFA8715921E2CFE03706B3A399D29F7835A7856879234000ABE3D4BF36155", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786452060, "uuid": "da277e9a-ffb7-4a31-8b65-f57597830176", "value": "24576:Han9SIluO1cv/8en01n5drFtSbXh8dDqvbE5azQLhD3b4KQlwokQvQJihI+ZQaFN:6n1R188ekrFt6g+zkazQLhf4cokQ4JiV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786452060, "uuid": "9d20f83f-6bb1-4207-9262-40031bad26ed", "value": 1466138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786452060, "uuid": "89c6cf9c-35e2-4df8-b998-f2cd29eca175", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786452060, "uuid": "2fba5caa-37d5-411c-a3be-2db777e8e3ec", "value": "PRE ALERT DOCS AND MANIFEST.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d2d3dc7-95c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786480227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786480227, "uuid": "1126518e-189f-40d5-bd5f-2ec1aecedbcd", "comment": "Malware payload (Vidar)", "value": "b2136f257487db864444183ce8d686f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786480227, "uuid": "a1dcde52-a745-4b38-8925-c8ee8e1db507", "comment": "Malware payload (Vidar)", "value": "a15de0943ba48371d3f813f3aae0909d0457ae7139824a7d0092d2891e5ae6d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786480227, "uuid": "cc86f799-c459-4a78-b6dd-9b04147877f2", "comment": "Malware payload (Vidar)", "value": "ac5981734fbb1084e049b6e39709bf693df3520b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786480227, "uuid": "a325eb4e-47f8-4192-8d9d-114b7535fe51", "comment": "Malware payload (Vidar)", "value": "272ad6b7b59edf66c5c556127e2b55855500dc4b930f775f9cb280a63e6e8488038e8b862acc070c9af2464ad54f1f6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786480227, "uuid": "958e0ebb-4c8b-465e-96d6-907b4a3dd0da", "value": "T1F4D59D0B2C9509FAC49AA33289B70193BB35FC554F3127D72E90B6782E367E19D35B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786480227, "uuid": "5fe68b8f-f0b0-4500-810c-6d393792f829", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786480227, "uuid": "00785815-2701-4446-9cab-b08331dceb05", "value": "49152:lmuuUwPn94JpL2l7oYDW+yZZBmI03uRKqQTupFIT4O:lm0tE7pWD300STYITR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786480227, "uuid": "85f50734-0a89-43d8-8fcc-5510255c3c63", "value": 3002760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786480227, "uuid": "02c1b63d-1d2e-4eed-82e8-83c2bcd24420", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786480227, "uuid": "c95ee259-4a13-4560-afea-6b6f4fc5b94e", "value": "a15de0943ba48371d3f813f3aae0909d0457ae7139824a7d0092d2891e5ae6d8.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "840804b6-95c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786480239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786480239, "uuid": "19147b66-de8c-42ac-8e22-8c9e22c253d7", "comment": "Malware payload (Vidar)", "value": "30df821dd96c980fd31f74f36809158f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786480239, "uuid": "6ae3e650-ae1f-4111-add5-8aa802fcde72", "comment": "Malware payload (Vidar)", "value": "a2290013b61078708377a486790f4368102498018394723cfd3f53683e325fce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786480239, "uuid": "b91ef5b9-1c67-4258-9a12-499b4ec637f5", "comment": "Malware payload (Vidar)", "value": "38dba88b3f7060817edea6c3c5e003d4e6745166", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786480239, "uuid": "9a286128-90f9-4c1d-8f00-d17a82d54880", "comment": "Malware payload (Vidar)", "value": "be8610d88bc2fac8afc8334658ac5e8518df52f71a956ee2990e32bd3eea600dd2263c3ef94ee9af111b547d46cca44b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786480239, "uuid": "7a082614-e67d-496c-b535-0a774669a654", "value": "T1C1165A037EA448F9C099E73188AB5252B674BC4D4B3133E72E50BAB82F763D16D79B41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786480239, "uuid": "6d8108e3-493e-4732-b340-fb504c228423", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786480239, "uuid": "8ad036a1-bbf2-42f5-bcb7-78bf5c246cb8", "value": "49152:aMpihVRw0dNX1spEU2Oee0D9XDNGJMRATRN8UL9/ccysIyXxuS5bC:aTzaj2okV0TkU5/cczXO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786480239, "uuid": "d3eb4b79-9c69-4a25-b004-26852f4241a2", "value": 4405104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786480239, "uuid": "c54e63e3-7ac8-4cb1-a205-c40bb52c11d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786480239, "uuid": "0805ccf5-c325-4067-a741-9440e70400a6", "value": "a2290013b61078708377a486790f4368102498018394723cfd3f53683e325fce.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1aaf5e5-9590-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786458518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458518, "uuid": "07069f7f-f3f1-44f3-8259-3c6d8c708b7e", "comment": "Malware payload", "value": "83c01037f021ceab82d5de0fececce00", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458518, "uuid": "ffa63b23-8fd1-4a12-8ab5-e2ead15ae9a5", "comment": "Malware payload", "value": "a22b28e9b6368efb8f858201c19f5f436ede92e52ca3b7077869f44a260068be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458518, "uuid": "cb74250f-9ae2-4d9f-af92-7e1aee00a6e3", "comment": "Malware payload", "value": "33fe5ff59066f61eb40257e402e3c225781d4125", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458518, "uuid": "15028fa5-5fc8-4b00-b12b-df49b0a1eb72", "comment": "Malware payload", "value": "77fb68a70db7da4d8104616cf8eda7c68c72dfe3567aceefa5cc675811b6194d95f0f7e953c36ef510089086095f7a0c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458518, "uuid": "51ab0377-4e08-465a-a6c3-370b6d6b840c", "value": "T1D2633B41E693C0B0E19341B00997F7E68634DF36941BEAE6EB9C7D61FC307824D9662D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458518, "uuid": "2425803e-5c66-4655-b1d6-070e145082c7", "value": "1536:118irznsBCJIQR7nElO9I0ND0PgtwhANyCmUr:1185BCJR0M0ICoyY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786458518, "uuid": "e5af0877-db9a-4d89-9084-d6b351e2ca14", "value": 70440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786458518, "uuid": "eccc7eeb-0374-42c3-8cd4-35bc16895de2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458518, "uuid": "4630d27f-d4cd-4015-8d1d-7c31471310af", "value": "main.x86-i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbd2784a-9548-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786427558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786427558, "uuid": "0226a874-9b5b-496d-a795-318bf595a8cc", "comment": "Malware payload (Mirai)", "value": "a21daa191368b2289fafb1f38413550a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786427558, "uuid": "5da0f384-f3f3-4236-b5c0-bb748e3ba4bf", "comment": "Malware payload (Mirai)", "value": "a28f193f95de3465f9dca27f2cb47329dc397cc6eae9670a9391d8dbcaa473b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786427558, "uuid": "806e849e-00cb-44d3-b987-f8c94a076401", "comment": "Malware payload (Mirai)", "value": "1536dad73d92a5c07eb81b1f4fddff4e53a00deb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786427558, "uuid": "b0cb3557-b03f-4c21-9646-0f4b6d001017", "comment": "Malware payload (Mirai)", "value": "9e8f47e8945dbafdee03837528e46a44ff5f66153a74193cd6f624f0753114fae56aecd418c92c888acfdb15f191efa2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786427558, "uuid": "e2b96289-cc4d-44c2-9c0f-546d880c160c", "value": "T1F7142A84B8827512C6F02277FE0F010D372657E8E1DE7337AE298BA9674701E4D6AE75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786427558, "uuid": "00812c2a-d243-4869-a4cd-710505292923", "value": "3072:UZceeF6kSdedwbppb9hGaZzi58olFUIr9uywpjFqWrzgsVnQfe:UZceeF6zeObppbLGaZzxolRDwpj/8vfe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786427558, "uuid": "1c555e2e-339b-467b-92f5-59a08091c673", "value": 195052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786427558, "uuid": "3b7f5da8-8027-4e65-b657-8697a7a660e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786427558, "uuid": "815b5ca9-93c2-44f8-945f-271fdfe00601", "value": "tarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "685ef8e3-956a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786441967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441967, "uuid": "3de89e35-d42e-4c2f-b6bc-7f9add93006b", "comment": "Malware payload (Mirai)", "value": "51823cd7870295d6f46a356588389bc9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441967, "uuid": "e2526b8a-58bf-4ed9-aa49-6c306ccf1991", "comment": "Malware payload (Mirai)", "value": "a293f56ed5ba1dd6a256004118109117a5f770a5073568c67ea344614a8a4ecb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441967, "uuid": "448bb2e4-1eb9-40db-8a08-b7a6c11702ab", "comment": "Malware payload (Mirai)", "value": "224d5d8253df5a791dfc0109387b7fc9bfccb728", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786441967, "uuid": "82cd6356-f284-4b34-879c-e1c5ea890d43", "comment": "Malware payload (Mirai)", "value": "d850c05bda28ae5d27504b66e5110728ea5be81752db377004d1fffc5fc601d6fd6931786b52f9cc94198594a8404cd2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441967, "uuid": "80734500-99c6-4aa3-a2bf-18482acbdd93", "value": "T1D9C32986B8824A21D5C913BEF92D118E331267B8E3DE7223DD205F2573CA51F0DB7996", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441967, "uuid": "4a0355df-0bd4-4236-8831-a9fee48f2fb0", "value": "3072:LFEl4/6Kl88A6ZdJLwMaoIdwFpec4eaF3:LFEq/6Kl88A6ZrLhaNcecwF3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786441967, "uuid": "79125331-c95e-48da-9830-b349fed1960d", "value": 120628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786441967, "uuid": "e87861aa-4033-483e-b06c-ecddda53d070", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786441967, "uuid": "1aa75ab8-eba2-4d00-98f4-adfdca46366b", "value": "Mystic.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90fcaf02-95ae-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786471241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786471241, "uuid": "47793834-daf2-4e22-a18a-b8aaec2bc78c", "comment": "Malware payload", "value": "42a2881c8f293c9900887a0923955e0f", "object_relation": "md5", "Tag": [ { "name": "agiapukaaywsvn-com", "colour": "#B43F66", "exportable": true, "hide_tag": false }, { "name": "dropped-by-SnappyClient", "colour": "#EABB27", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786471241, "uuid": "713ee970-eec5-4a31-8802-49ff650ffbb3", "comment": "Malware payload", "value": "a2ac3452f8d34987d57c0035fc4d5fa42d59f9f7e2ebdcdc80c58368c41d44cd", "object_relation": "sha256", "Tag": [ { "name": "agiapukaaywsvn-com", "colour": "#B43F66", "exportable": true, "hide_tag": false }, { "name": "dropped-by-SnappyClient", "colour": "#EABB27", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786471241, "uuid": "68b38d36-152a-463d-821a-e95b57e46a2b", "comment": "Malware payload", "value": "acfe65aa3829bbf33b6cf3169ddc3b638863b5af", "object_relation": "sha1", "Tag": [ { "name": "agiapukaaywsvn-com", "colour": "#B43F66", "exportable": true, "hide_tag": false }, { "name": "dropped-by-SnappyClient", "colour": "#EABB27", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786471241, "uuid": "cb635a8e-59bc-4c73-8fc8-b9c13935564c", "comment": "Malware payload", "value": "de84c65c18b15b7cfb055b88ff62892045f778e9effe4967bf2f99b51659c3284b43f1aee8c091fab025bc8ea28cb503", "object_relation": "sha3-384", "Tag": [ { "name": "agiapukaaywsvn-com", "colour": "#B43F66", "exportable": true, "hide_tag": false }, { "name": "dropped-by-SnappyClient", "colour": "#EABB27", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786471241, "uuid": "82676edb-fb1e-4171-8886-51d6bdd750be", "value": "T199183396937B2C37D9317EBCF485599C18D5C28901786A6F8A3E018A0CB36D537F2A1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786471241, "uuid": "8de818ba-459a-49ac-bc0d-8312fb097b45", "value": "1572864:A7UdA27917Zvv/L8JrZVGiSDfzRkKDq0LU45YbLpvMgyPXXPgYPf:e+A2Vvj8JUD7G45Y3p1E/gYH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786471241, "uuid": "b04e99ae-be06-40d1-a1ce-051c8544bb05", "value": 85609008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786471241, "uuid": "4e7ca13e-a99c-4a24-aa00-d344cb057837", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786471241, "uuid": "863aaa86-fb81-4a7d-80ce-5b02d70f4ef4", "value": "boost.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58b62c5b-9591-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786458691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458691, "uuid": "ffcc806e-f3e1-43cf-9dee-153ba4fa6905", "comment": "Malware payload (Formbook)", "value": "eda579c9a84b495c600d202fae5c5007", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458691, "uuid": "1ebc8d7e-0a82-4741-97c8-d3d5f9776dc3", "comment": "Malware payload (Formbook)", "value": "a2ba9ad1392dcd7d2527d199852cb4b590edb3e93f6015c2d5991882f1c3fcec", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458691, "uuid": "23b35f25-031c-4839-b799-7b7e3b151e77", "comment": "Malware payload (Formbook)", "value": "3ad656b5b6d9400ab932b7613e487993d7095b48", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458691, "uuid": "3bc82c7c-3911-4817-bf9c-0ec5186a8196", "comment": "Malware payload (Formbook)", "value": "1b094e2fc8a80c34be61f8dfca900215a66ccb187d938d95af3fa3d57feac922782c63852c6980d6e1fde6201f5ccbc4", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458691, "uuid": "a4afa2cb-5e77-4db1-ad6b-0e86257d9dd6", "value": "T168733F485983B98493337F7FA22A5894F77A076700994D1B787CB490AFF1C09DEE18B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458691, "uuid": "f8c6c9d8-8210-4af5-90c5-2b231ec44ce2", "value": "768:fXbbADfjoAkANbllfDhw5ErdLPH12WwKcKaRuGnRcVeKZNr6mhdB4reOwfKUvUFY:zkQA3dCrx1hNYR40JgE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786458691, "uuid": "8a4b9f61-5687-476c-ad47-9b9499326e95", "value": 77377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786458691, "uuid": "849615b2-c371-4b8c-a809-476855d3104a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458691, "uuid": "7d9df475-6ea9-4c3c-8d91-7ccfb79acb53", "value": "Order-Mokki-ref26081107.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e86d0a4-9560-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786437656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786437656, "uuid": "59d598a5-031b-43ba-839e-71e65da3d6db", "comment": "Malware payload", "value": "8c1ca7398246703c6df6ff1f5f3c2afa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786437656, "uuid": "801af113-6424-44e3-b43c-07b0cf96e23f", "comment": "Malware payload", "value": "a3f23ddfd3dd058a1f60dda50ad5a08e31522148ac7739c4df3b3b498ece4637", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786437656, "uuid": "bb335cec-1f55-4b47-9cee-7f3a70c37bc1", "comment": "Malware payload", "value": "a591eda7d3ec0099c80a18a139348e16847ae2ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786437656, "uuid": "6b3189d0-2299-4f75-95af-034c7d09abc0", "comment": "Malware payload", "value": "632ce3f6a9325eb59ea1dfd5dccbcfe71e794e794bba11b54ff44c999649fb4e18bd5260d55f6d1354bfef7167acae8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786437656, "uuid": "3b5471ed-2f98-4c47-86d2-9fc8f2e79b43", "value": "T1B8B40100EE8258ECD07A877059B75A5320337DEC5C75F11F9A58B7BB7F729818A3A206", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786437656, "uuid": "a74a36a4-e529-4d4a-bf37-c8358c1effeb", "value": "9be4f90f50c714bc00cc8beb2e137299", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786437656, "uuid": "92c3f176-577c-4232-a796-15dc0700723f", "value": "12288:qLiUZG8a8WoSODfsYFu6SlICntgp6S3S+pkF:qxZG8a8tXVkICtb8KF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786437656, "uuid": "cf046731-9ea9-4f44-90ef-d40890030111", "value": 494640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786437656, "uuid": "de739e59-f8ee-4d76-8d1f-1f3e9f2aae08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786437656, "uuid": "313fcd61-baf4-41be-834a-4501aa75cb94", "value": "uks.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c405a83-959a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786462670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786462670, "uuid": "f681cd62-cb3d-4484-8782-c410ed35aaa4", "comment": "Malware payload", "value": "7478bff5bd2b60105e2ca70636b28380", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786462670, "uuid": "6cd0386a-8a48-4aa6-b385-d10dc3b7f48c", "comment": "Malware payload", "value": "a3ff53599fd1b0be51ca8df3dd3a1eb667e2dfd4b62ea480dbbd22a2d0e5fd2e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786462670, "uuid": "ae699d52-a207-4c92-8fcb-de8b965dc9dd", "comment": "Malware payload", "value": "e39a62f0ec34becae007ba33e4ffffab42e28cfc", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786462670, "uuid": "e774e70c-be28-4488-b3ee-ae9b51367095", "comment": "Malware payload", "value": "691f0596b6d794adbbc396ae6aed76f8ada9723b41b3143f588aabe592adbc29d675c7b1226c0a592ca97e10a9e434a3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786462670, "uuid": "3729ff61-946a-42d2-8a70-3374fff032ba", "value": "T1A8C27C966A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8A3C71DC11F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786462670, "uuid": "f38389e1-fe49-4062-b885-d47e81917d61", "value": "768:P8vCB+25j6es8R59FYpMSUpi+20qUpi+20YQX:P8l25Jfd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786462670, "uuid": "dd4cd8ce-3e5b-4f0e-8f8f-c2ca831e716a", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786462670, "uuid": "fc15aaa2-9cdd-4eb1-943f-ec9272f88ab7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786462670, "uuid": "61683afa-0d1e-44b0-91c6-078576be84fa", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f6e9a66-9573-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786445818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445818, "uuid": "b6e1e362-d6d4-4a78-88a4-12c4006f293a", "comment": "Malware payload (Mirai)", "value": "8fd103213146a59bba20486c966d36d2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445818, "uuid": "6ff6d004-400c-4829-9d4f-d81c2aab6882", "comment": "Malware payload (Mirai)", "value": "a41e8f28b1401566fcb1da20220e34d05f9c9fe46fe5b47e0abaabe430ba175a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445818, "uuid": "4a84d46b-155d-494a-aadb-a4057a9a5c50", "comment": "Malware payload (Mirai)", "value": "9e0df9326151652756422f8f40f263dddeb50eb5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445818, "uuid": "ebfd55f5-c8d7-4b43-ad60-922b79226fda", "comment": "Malware payload (Mirai)", "value": "654de22b325dfe8392b4b12de98dcb9e9fae861c9035e62c11bb7dc035a22134e260327c908d4763b90e486ebbcfaec8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445818, "uuid": "6ea25620-df89-4a53-90c7-938e6f8acac6", "value": "T1C753F16AC41A168BE56DBFF87D9B0DC03FCBDB22B9A18078320299769573874FA115D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445818, "uuid": "50ed5428-8740-4ddc-bc49-f73500902ca4", "value": "1536:jP2L4cifQPBvn2UVQLTlTmTjLj4oOSfZw1nd4u+qgw09O:jP2L4caQPBfdQvZmT7jTZI4u+qgwr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786445818, "uuid": "ffdd2104-72b6-447f-8a18-5547c7adb7db", "value": 65008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786445818, "uuid": "1dca3049-5f41-4cc5-b526-6018e9aa0193", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445818, "uuid": "5715fa3e-d8f9-4cf9-9f90-623bd72c9994", "value": "sdfjgnjsdf.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc385d9e-954a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786428471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786428471, "uuid": "9841b6ce-1947-4413-b708-a734bcaf11d7", "comment": "Malware payload (Mirai)", "value": "037c4b81654769a12d60496aa3fe1006", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786428471, "uuid": "aeb48784-f5f3-414f-884e-954e42510d98", "comment": "Malware payload (Mirai)", "value": "a4238c8df0e716b06329b3f4872246c2df47b284df63fa55069c85fef90a0dc7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786428471, "uuid": "7245f59a-9b8a-4ba1-9284-7e1bbb1403b0", "comment": "Malware payload (Mirai)", "value": "06d690acd9c51a1da64d0441b98dc6baec33ce46", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786428471, "uuid": "192f194e-be3f-4a5e-b677-fa6a6339a4a9", "comment": "Malware payload (Mirai)", "value": "826297b94eea1bed6cb649fe9b5d5013798e35fcadeca2d39059457dad9d26e1b43b8f61c586e32c6113def1dc1a4a03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786428471, "uuid": "76bded96-1351-471c-9d5a-29bbecc85505", "value": "T13083391ABD819F09D5D126BAFF1E534933531BB8E3EE7102DE246B1427CA91B0F3A441", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786428471, "uuid": "0ab73877-819c-4163-8942-562dfb3d19b7", "value": "1536:FVnpiVMiiG0PzwapyF1ChGfZrwBYBXKSYjs9gzrkl+0lZdlcNiFXN0n4X9:QiHGMzw0GUWXKSSs9gzrklHaeXNi4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786428471, "uuid": "3a3c2365-7de9-4b18-a75c-5e412dec4d44", "value": 88388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786428471, "uuid": "0ab13ef0-efed-4069-b3b5-6dafffd67a84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786428471, "uuid": "20e4682b-910d-474f-8107-916f8fd65482", "value": "1sPM", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "473f6fea-9562-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786438475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438475, "uuid": "e537aa49-4dd7-40f4-a080-f4794e931126", "comment": "Malware payload (AgentTesla)", "value": "6d7d8505c440aac7cf0fe1c644df074a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438475, "uuid": "68c168ab-d521-468f-a4e4-03b42b2ac9c9", "comment": "Malware payload (AgentTesla)", "value": "a4406c6b7b8bbed10bfc8417be9b4b60dc42038809ded7b96e2fd469e81ea395", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438475, "uuid": "01960d0d-b78a-4568-9ef1-6248afe3da05", "comment": "Malware payload (AgentTesla)", "value": "98dd9267c32146fdd5c67938a066efd352c1a626", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438475, "uuid": "ca0c2850-e53a-49b3-ab57-101dfc182cb0", "comment": "Malware payload (AgentTesla)", "value": "30914747ae5d45289a79d23d243fee858c09ffb0fcfaa1dfd31983263e667a14195367863d6987c2137bf7a9457188e7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438475, "uuid": "9fbeb798-557f-4cce-8552-97fe623cd4df", "value": "T15C95F8C638EF280F0572BB88D58C699C079B7669CA837A90F4DF6680071F8951BD1B5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438475, "uuid": "708bf97e-4276-4d24-a5b2-1f89bb89b160", "value": "24576:TSlsyYWsUhvMESpybE5xA69T8J+m2UDnHhN:dpybE5xA69T8J+m2UDnn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786438475, "uuid": "57204bf0-3f0e-4f45-b48b-4eeaf00f099f", "value": 2012670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786438475, "uuid": "277a4401-2c81-48e0-ae33-855939493176", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786438475, "uuid": "0315ab96-c6af-4424-a325-81e0d3b37bf9", "value": "\u00d6deme belgesi.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d5b63f6-9550-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786430647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786430647, "uuid": "df9b037e-7a72-4f2e-becb-cae056587c81", "comment": "Malware payload", "value": "4df7db0045acfb4f95479181d7b23f3d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "i386", "colour": "#58A09F", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786430647, "uuid": "4276951e-093f-4b58-8792-bb6c2d9ce015", "comment": "Malware payload", "value": "a4495895784d539f2beede7f95a1e898ae46064d9c1b9e0612fc02171b06b449", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "i386", "colour": "#58A09F", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786430647, "uuid": "614a2a76-c6e3-4e28-b15d-3c5d20335187", "comment": "Malware payload", "value": "790c18a210f6e1878cff2ad5dfedfd0cb959d4c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "i386", "colour": "#58A09F", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786430647, "uuid": "b2a3ac5e-dd1b-4fba-bfb0-afee58f9e07b", "comment": "Malware payload", "value": "41d89fbbd0a9ce3c7123e374054c8c0a90f4fe47beaa10d9f4837416aae3adf16cf0594f9a92729316cc788e18049af5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "i386", "colour": "#58A09F", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786430647, "uuid": "0fc3392e-0309-4005-bf13-c4f6f370ba8a", "value": "T1BEE4231F76E1A2876F16633C34C2BB7145FF1300148D5D83759DE22899252BBEA1B8AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786430647, "uuid": "d914df17-e80e-46eb-8b45-6632d98fef08", "value": "12288:zSnZLbA/t3n9dqqgcK6aBXjqwmP4my5u3R70OGkPt4ngVjFJfktrH36wwQK:+nZLo3SaxaRqocd0O5PV8q5T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786430647, "uuid": "518743df-b288-4140-ad93-e30a0e5d98ed", "value": 688128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786430647, "uuid": "6ae5192f-02c8-4a55-97fd-9132063b2c6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786430647, "uuid": "a03c88f9-dcf2-4276-b1ff-8c1afd866af1", "value": "20260810-230208_sftp__home_deploy_redtail_i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "857c2139-9573-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786445881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445881, "uuid": "f1f65a1b-b6a7-4e39-b372-6685e983fb99", "comment": "Malware payload (Mirai)", "value": "2b6108f5e06fdcd98850f0dd34c92702", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445881, "uuid": "5549605e-a1c0-40a3-8d16-a04a8afb67fb", "comment": "Malware payload (Mirai)", "value": "a44de3fea48de09ce93963d7cde4f9a6a2e6e132688313193595a0190fdcf622", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445881, "uuid": "e5324b18-c06c-480f-97ac-5b98b3546e7c", "comment": "Malware payload (Mirai)", "value": "416685ba66455ce72924d5357803caa5527ed39f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445881, "uuid": "f632d093-e223-4b19-9e96-ef0f54d7005e", "comment": "Malware payload (Mirai)", "value": "d1c7669cab32aa0f7c13e9269dd03405c3200d993ceb05d4255d840ca2d95d0000697e998f8bcd8dd4a87d0f91cac8be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445881, "uuid": "e21960f7-bd5e-459a-b807-036350d0fb5e", "value": "T148046C17BAC184FEC8DAC1709BABB13AD970F05D0238725B6794AE736F4DE301A2D654", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445881, "uuid": "15614e2b-174d-42ad-b6cd-aab4dce9e51a", "value": "3072:Zga89+/3RCd2a9prAK/Oxym5BISyFxkYi9kLm/7SD:Zga8ICHi2eN1zw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786445881, "uuid": "3ec44582-b59b-42ec-9f92-83f8b666f7b7", "value": 179864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786445881, "uuid": "c0d615c5-e053-4bf3-b449-77020a4c3211", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445881, "uuid": "5ad8c043-c47f-49c1-a18d-cdbe25ce039a", "value": "sdfjgnjsdf.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f99dad4-958b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786456018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456018, "uuid": "eb7095f6-0a57-4050-9412-132a82215efe", "comment": "Malware payload (Mirai)", "value": "7d91ae879d03de55d3c82a33fcad457f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456018, "uuid": "e501a2b3-7351-49d7-89ac-ab970de5af2b", "comment": "Malware payload (Mirai)", "value": "a49bba3715642957c6abde3d3ce3784bd3e5c3cc9d77936746e75d68fd62e9d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456018, "uuid": "5f7ac446-c422-4190-a7fc-a383a8e03267", "comment": "Malware payload (Mirai)", "value": "93a4d0802f5e15d7f3c6e9c309f8fb455b9d11cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786456018, "uuid": "9525416b-08f0-4bb6-aaf6-0daa7d35af31", "comment": "Malware payload (Mirai)", "value": "33fc59cab99dc789ca9784df61a0fe1a6a4dd81ddbead79af9fb02b1d3893d78cc1628cc2510939256e393b99eef5404", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786456018, "uuid": "ad06b866-d94c-4f8d-a5e3-b44e26e47d4c", "value": "T107F37CA3D8256E6CD218D4B0B4219F7C2B23E57581831FAA9967C6798447ECCF9093F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786456018, "uuid": "f7a7bd7c-5de1-4285-9fba-fe386296de82", "value": "3072:T92gcA+jf7CDnk40bT8aC2X6AAW/qoIvAQxBsN:T928k4qT8JqJSbAQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786456018, "uuid": "57b4802e-a2b8-4a7b-82e8-7f72757d33ea", "value": 159172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786456018, "uuid": "2d5b8c5b-4504-42b0-8049-04915c8e5805", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786456018, "uuid": "ece16e22-c086-4f81-bd66-3c270c6d372c", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccd125ba-9565-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786439988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786439988, "uuid": "464eb06a-0dcb-46e5-a8a8-8cb858a1d24b", "comment": "Malware payload", "value": "0f0f5bf5f4426304cc5e2badee78cb45", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786439988, "uuid": "84653408-150a-47c7-8a8d-a2c21d700dbc", "comment": "Malware payload", "value": "a4c2ad6537390d2d1dcb919c1363dab66acfb2ded9c5843ab7bc128eec118b91", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786439988, "uuid": "51c04343-0370-41d4-8571-47782755bf82", "comment": "Malware payload", "value": "b150d7307f39b63de143db7e09b963d96546393a", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786439988, "uuid": "8cc479f1-a317-4348-81eb-7b4df3544d5e", "comment": "Malware payload", "value": "cba9670cc0465c2d89f633219bdfd204082b10ef9b7bcb9cdafbe58ec6562aba2b1baf57be3e953c0a3cdcbf282c27d4", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786439988, "uuid": "8491b63c-e160-4341-a59d-db5206898486", "value": "T11C92DE3D36003AA61BAD8A098A2F11807E76544F03157DD971AEA17FD776F907BBE0C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786439988, "uuid": "18ddeb03-a451-4b07-8ca9-af37950ab035", "value": "384:QpVWRStYIqTrXDPjQim1Tr9Sqce+p2v6HFpftGIexG6OncZG:QddN9mWDHGVncZG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786439988, "uuid": "31508dc0-c2ee-4b91-acb0-5b1f8960d2c0", "value": 20458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786439988, "uuid": "489dda13-28db-40d3-a7a5-f4d5e45d320e", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786439988, "uuid": "a8ef64cf-4aea-4e0a-aaca-22339c202210", "value": "Adobe_Reader_install.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2de473db-958e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786457331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457331, "uuid": "b9e83614-5770-4e05-89e0-b3ae9d04c62f", "comment": "Malware payload (Mirai)", "value": "98fd741f932692a6d9953ecb0a72466a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457331, "uuid": "f5c78139-2c9e-49db-83b6-b6b67a33d5a1", "comment": "Malware payload (Mirai)", "value": "a4f056fdc2c957b063448ea3d211fd2f5d106da535cb33d23a84cb2019c1c839", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457331, "uuid": "face9a5c-96ea-46b1-812a-b9ae4bacfed8", "comment": "Malware payload (Mirai)", "value": "e3864264b0e2b139cc80f65c5391304564bd0b3b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457331, "uuid": "6daa295d-1aec-4c1b-ba1c-61ba0294d9e4", "comment": "Malware payload (Mirai)", "value": "79d2ae03557d536aee86600c8eac50233165529bbc3f0415d2401f0ecc44bf562370ceed1fa69807f33692f4f498a759", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457331, "uuid": "adfde774-22f6-432a-aec9-607db1c5f8df", "value": "T117E32AC7F800DEFEF80AE33648570905B630BBE115921B372257797BED3A1991963E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457331, "uuid": "58132b63-70bd-45ee-bf8c-a2d5cc3b881c", "value": "3072:umhTDH80J878LKxlpjARKWidb0Q9imVvjbiWL3txyQUcmq:uETDH80Jo/jARKndb9iILvyQDmq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786457331, "uuid": "3cf01445-e3ce-42d9-857d-029d3e67ca3d", "value": 150464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786457331, "uuid": "e6481373-ea6d-4170-9591-77d655e8db75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457331, "uuid": "987eacf1-c2e4-4d43-a580-b85ee1d45db0", "value": "bot.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c447f54-9572-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786445463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445463, "uuid": "a6e831b6-b82e-4880-89b6-4612a778bb72", "comment": "Malware payload (Mirai)", "value": "efe8e7cb6dad0b585f176c3d95b1638c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445463, "uuid": "6f86de58-14b0-46e1-869d-0b66469a28ed", "comment": "Malware payload (Mirai)", "value": "a50465a50e203741124b3914c4ec7d46b94ec9af2437febab3803000e79e9c82", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445463, "uuid": "a8344047-2a64-4664-a35c-89c3474c5791", "comment": "Malware payload (Mirai)", "value": "6d72f5441077419fb26829154c676c54b5fc648d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786445463, "uuid": "30df7a5a-0d47-44f6-8382-186a36957703", "comment": "Malware payload (Mirai)", "value": "2eb7456d2e0abab541f42d88285471242e9c4a1b330aa9007af1d95a51598cfb5bb9d8e401e7fa0f5623c68cb6570552", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445463, "uuid": "706acbe6-9528-477c-a8d3-9995aca69d71", "value": "T1D5043B02B31C0947D2632EF4363B27E0D3EF9AA220B8F645751F9A899172D375586DCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445463, "uuid": "d2e706cd-5305-4de1-9bc9-d1f654a1f33a", "value": "3072:L9W6FYyMeLmZyomJZnxvAeTbsopmJW6RdvmvBtc:5rHKZyrZnxvHHsopeW5Dc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786445463, "uuid": "1c0a4d16-80f9-489e-81d1-1a35187a461a", "value": 178896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786445463, "uuid": "cdd7da77-aff7-4fd9-a025-74ddf0b0f9fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786445463, "uuid": "67447bb7-826d-4f2d-9413-c0b3b8679000", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93976b2e-9579-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786448482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448482, "uuid": "5dffe15a-9323-472d-974b-2e91ee494eba", "comment": "Malware payload (Vidar)", "value": "586604afa0196b63932f87b4aec23ed6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448482, "uuid": "07986ee1-7540-4b0e-a2e7-c0e2364ea82c", "comment": "Malware payload (Vidar)", "value": "a59e4812b8cb9748fd9bd4e34fb25996d862659fe4fab679e812ab97b604af27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448482, "uuid": "c75307ed-6b0a-482c-8da3-28908e2c7138", "comment": "Malware payload (Vidar)", "value": "d3feb4d4b1f251b602c5840bc09b9496b8350540", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786448482, "uuid": "903b4053-dc2d-4104-86c1-508a3a0f374f", "comment": "Malware payload (Vidar)", "value": "302ca00a8e2488e8deab6e80ccea98ce4d977c67ad6739f4d7514576aa345e9a334ee3b15a579e86911954925735cf01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448482, "uuid": "3295d586-a8eb-4c61-b90b-c9ba2b649723", "value": "T11116AE07FE9058B8C469A27298E34681773CBD452B3227D72F90367F2E76BD06A36354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448482, "uuid": "3396f619-af3c-4874-bd55-abf00dc65248", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448482, "uuid": "4e0893f6-3212-4561-aa4d-4f9aa85cd702", "value": "49152:NU4yOMj/vdrsniaDNbGia5Pu/S15HCYNBy2n8qZ9KW9AHncpYVY:NDMN3yg8qZ9KW9ccWVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786448482, "uuid": "ec77ca5e-f6f1-4d05-915e-266799e884cc", "value": 4075304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786448482, "uuid": "53adfb4b-2e15-4bf9-9813-ae7d75dcd515", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786448482, "uuid": "bfde9c9d-3189-464a-826d-e388fb588dc7", "value": "a59e4812b8cb9748fd9bd4e34fb25996d862659fe4fab679e812ab97b604af27.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c3280e3-95a8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786468441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786468441, "uuid": "355e8ff7-eb2d-480a-ab5c-347031a7c28e", "comment": "Malware payload", "value": "35984975fd52c140dd5ed2630e2bb2b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786468441, "uuid": "35f73c71-8f5a-47b3-a40c-ee554d6f116f", "comment": "Malware payload", "value": "a5a561b6be8eccf0f904b751d4804c2cc1e86793f1085735a6784856f9fde268", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786468441, "uuid": "f4d67f15-f03d-43a9-b72d-7d9ac2a76130", "comment": "Malware payload", "value": "d27d876a87dde88b40b9ed743b693d50bea393f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786468441, "uuid": "7d3d7703-4361-4a97-9c08-8745413b26d1", "comment": "Malware payload", "value": "3ad8bca77d69f22a8704b3e5e5cd5c9b724d393600cd22c2e3eceb942c7208df28295a46deb32bb7502651d84f95269e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786468441, "uuid": "caf426d9-e15e-4fc7-ad4a-01fac0b93adb", "value": "T1BED318177A270D22F4D10135A2BF03E2BFE283CB35784E97B65109D9AF276A074932B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786468441, "uuid": "2fda440e-a19f-456e-9b2b-b4ecff35632d", "value": "1536:sNkC1RQJjYlKkhGyUuuTBUg5OrURZtnj7I+n5p5L1lPC:sNkKeCUkhPUuXgVQWpC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786468441, "uuid": "e57c9bef-c1df-402f-ae57-91433b6ce52e", "value": 132480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786468441, "uuid": "9fafe669-a091-4414-a0bb-c81a9687e870", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786468441, "uuid": "b3963218-46f4-4c34-9278-9b7ac8994356", "value": "a5a561b6be8eccf0f904b751d4804c2cc1e86793f1085735a6784856f9fde268.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ee50f9c-95ba-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786476230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476230, "uuid": "cf22a1aa-28d3-4532-b83c-09dba1d0c097", "comment": "Malware payload", "value": "dd3c89f9c9ea3ca9e63620f9f1ece231", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476230, "uuid": "14c26d10-fe84-42dc-9f31-45e206ddf972", "comment": "Malware payload", "value": "a5ac3c957bf2662e5f739f1a84d0f384b5fc8bdfed92c1dd3ad5df42e586893b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476230, "uuid": "5ade4192-32cd-4fd6-a226-cfe24ffd2b2f", "comment": "Malware payload", "value": "ae1d31e7398bcad434c88e42c85fc981cf02553f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476230, "uuid": "da876d7d-02bd-4a9d-8146-22212d0ab39e", "comment": "Malware payload", "value": "25cc838e4023ed47690a52020e37b90029c5de6c11c9d0c40a9cef039a1dde36abcd025997bf5849d43de9cda6ba17d5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476230, "uuid": "1e97ffa0-c546-4042-b893-7f77c62a0b37", "value": "T1B8236D6516857C24AA98C4371D7E2F0CBDAD43E6320492DE7FCA3CF28C5AA9DD10971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476230, "uuid": "a5a68f98-d2ba-4afa-b091-649be5107fd2", "value": "768:dXRWNGxVv9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:nlxCcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786476230, "uuid": "e2949b0f-0460-4723-886b-9ef248f595e8", "value": 50039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786476230, "uuid": "5d96e021-731c-4b50-8f2d-3961dd81af87", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476230, "uuid": "75bb7828-0773-4a80-bb76-5a7f2d5275a8", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6a2a903-958d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786457131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457131, "uuid": "b129ff27-16fd-4f5c-a11f-c9e1b8aa124c", "comment": "Malware payload (Formbook)", "value": "6473f7fa8bfe19d4910bd5e8cc9eaadd", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457131, "uuid": "a8f0d2b8-0b7c-4fea-88db-3a6d76418b5a", "comment": "Malware payload (Formbook)", "value": "a66979f3bd65f8c836f64bd7c6f0f74517d95c95921e8e2db82c17fdbcb79504", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457131, "uuid": "a813ae9d-5262-4f69-b684-bb9cba1c248c", "comment": "Malware payload (Formbook)", "value": "83183e6d11e2f54829c84b61ffd5f374fb46252b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457131, "uuid": "5f02967b-af5d-4624-bc39-fb0f1115c860", "comment": "Malware payload (Formbook)", "value": "9d17154d9b5a4aa46ecba9ae2b175daec951344201423bcac21cb7fff81c6b2f20871f61f14bdff437a11c735ef149f8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457131, "uuid": "00913968-bd87-458a-91db-994c5cbc838c", "value": "T11A56F873638E2F0B9D157302A84D2A491E5DE198AE43E6D8F0CF63D5110F45FAAE44EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457131, "uuid": "99506f9b-d02c-4359-a981-e10e4f98e5d6", "value": "24576:m2EHUtQkYeKCezYPHQPWQiicq81ErLD16ceDZ6q7U7wtRyB2EHUtQkYeKCezYPHh:VEH+vlEH+vf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786457131, "uuid": "23e5a856-c951-4f00-ab58-f664b292c738", "value": 6181097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786457131, "uuid": "a5da774e-353e-49e6-abfd-02aad4139338", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457131, "uuid": "5c8a04e2-ea27-4802-a2fd-1d5c1e4bc028", "value": "Ziraat Bankasi Payment Confirmation Copy.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ca5c3cd-958e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786457302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457302, "uuid": "151df2ff-135b-4c40-b771-89e7512a4508", "comment": "Malware payload", "value": "9275941263578d97f40a170957ce81a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457302, "uuid": "d5bc4486-8bf0-4ee2-be2d-cdbebbbca770", "comment": "Malware payload", "value": "a66b28d03ec3f0c9b36b4c9a8f0058d2cef641a8ec4cef9e07a219d90909d6ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457302, "uuid": "663a2b07-d887-4d15-822a-2e1e596cf247", "comment": "Malware payload", "value": "2d11d3d1b6735e4c79b25d5c7f4a84042332bd9a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786457302, "uuid": "706ab9bc-5cab-45a1-adfb-29adbbc661b0", "comment": "Malware payload", "value": "8ae87dd205091f382cc6ab4bf94f92f1f4676600da5786d6e0e2a12c85ba55534c913dd49e3edebd71ada4d8b78e3737", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457302, "uuid": "f4c51272-d731-441a-a877-5ed807aeb3f2", "value": "T106D4D90B6E328F7DF67587314BF70A24AB6D23D623E1C582D19DD1141F2128E592FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457302, "uuid": "235ec3a8-cee9-4499-86af-5ba373169420", "value": "6144:YECVsBp8H65M+GA5ZqM/IYYLnUF+OGt9hZdTdNhC8SgsMH5f5UIOEZza4baGXv1w:/Ccucn54rLnb6GXv1IEI2zCqnqAM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786457302, "uuid": "9891b398-0b83-4592-ad0b-399ab62ea44a", "value": 648320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786457302, "uuid": "d57c2c63-a304-4f78-aba0-c6275f33f5b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786457302, "uuid": "720e19dc-5d1b-44b9-afba-ea6a81ab118c", "value": "mips2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f66ed64-9597-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786461226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786461226, "uuid": "155c2dea-65d3-4302-ad93-58d0ed408085", "comment": "Malware payload (Mirai)", "value": "ff84e87ef752db00a5504145128e6a38", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786461226, "uuid": "b0a8dc49-040f-4027-baa5-140d66b0bda2", "comment": "Malware payload (Mirai)", "value": "a676af6ae1ca7cdd7f316016de4e4ca1279d33e409105aea7818638553572256", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786461226, "uuid": "b19ce101-f383-47b8-bf79-4e31cbe1ee92", "comment": "Malware payload (Mirai)", "value": "0d45109526ec4c40a5f69c74692613d7ee67e352", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786461226, "uuid": "b1e2a409-705e-48c6-96ff-e721161403fc", "comment": "Malware payload (Mirai)", "value": "d9243905e28a7af501589b893756658c8746cc3c4a9b137efa9138b96e3a6b1542bcc41a52c4d7d2b581abf99af2a78d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786461226, "uuid": "4968c9db-f8c0-4e6b-94b1-9549d923b0c7", "value": "T161832D85B982869BC5D4677BFA5E918D332257F4C3EF3202DC154B243789A5F1E37680", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786461226, "uuid": "ad5d29c5-f534-4b94-aadf-0f7284e30541", "value": "1536:kSIlabILV16aFan5tdJ470EGyY9NePd88H:kdlWIL/6ean5KGyFF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786461226, "uuid": "db656131-2f1e-45b9-aec8-034bc92641f0", "value": 83236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786461226, "uuid": "559bb751-3f18-45dc-8aae-b32671ca2c29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786461226, "uuid": "615c5d47-8bb1-497e-81d4-056823108736", "value": "sdfjgnjsdf.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48ad85bc-9588-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786454799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786454799, "uuid": "66564af6-be5b-4d5d-afd1-e8d17204533e", "comment": "Malware payload (Mirai)", "value": "400e1b6beed18da38a7790d1e741ea9a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786454799, "uuid": "1cf6be81-f6da-429e-a788-56c89eaabe06", "comment": "Malware payload (Mirai)", "value": "a727fe08eff5a9b128e5dadcbfc8b6747c9240804dfdd2ad770f79a586d2233f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786454799, "uuid": "067b0c00-b818-43e3-a365-7b61feb3c197", "comment": "Malware payload (Mirai)", "value": "48ecb5dc675e197532cf5a99918f84334ed47ae6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786454799, "uuid": "2cf894e2-6f84-4c65-ae24-e6d64672fe75", "comment": "Malware payload (Mirai)", "value": "cc964c94764d8c66a024abd9f3331672191cf9304938e680ab383a8d725ae3217dccbf07e65b6bd79539834b256c5239", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786454799, "uuid": "640130ea-b923-4cad-ae52-16ca24421e1c", "value": "T10603F741759184FED09BC2349BBEE52BE932B85E32317A5F7385BB351E32D201E0B691", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786454799, "uuid": "71337540-a245-4295-b233-90f16606261b", "value": "384:pVFLhwZ17OBmUFSiJkpEuKcxi+IbYKh/AqNX6/sGflLFjN1GF/qzQ2BmtKgnemq:p/LKfU0Kcxi50KhFNNglJjAyrMKcem", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786454799, "uuid": "0270b1bd-f3d3-4a05-b4e9-617d9e34a667", "value": 38760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786454799, "uuid": "c84cabb5-497d-43a3-9ec4-970ecfe181c6", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786454799, "uuid": "b4672f1b-4c08-4077-b259-da45889403b8", "value": "mini.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cb54419-9591-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786458671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458671, "uuid": "1a5656aa-9ac0-4c76-8139-a808f1d4fcb3", "comment": "Malware payload (AgentTesla)", "value": "7503699cc8f96ad69f55e507cb459e44", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458671, "uuid": "9945cb84-8192-4513-acf6-eed72a1823af", "comment": "Malware payload (AgentTesla)", "value": "a736896efc10ad2d3033cbdc7f709ddc9b209f1ae3e18175e62376b413c3c260", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458671, "uuid": "75ecbaaf-9ad3-4fdc-a27a-a9ed25d49914", "comment": "Malware payload (AgentTesla)", "value": "0ff8e2975ec7466b7da99c847742f7be682fde5e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786458671, "uuid": "d6f41a3e-7687-4449-a646-2cc9921fd088", "comment": "Malware payload (AgentTesla)", "value": "90276c5c1fc655ddb15dc8661e4028d10b88f1fbdafb2046db792a8dff5403920973cae644d60c21af3fbd8bc6ae17c2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458671, "uuid": "51e08cd1-fec0-4e93-9934-cb069f2ba730", "value": "T1CA2522B5CAEC501CA0312AD95C4347B9AFE5D9144A2FFECC722D639406D1EDAC62CCB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458671, "uuid": "48b3d534-05cf-4a4d-bbc6-02a48e0f5fe1", "value": "192:UIwWuiIUYWOIAIeIIGaIWIISII+II+eCIc6IAE44IooI8IWICIUSWIwokoqIWeOg:F52LcEaLr6CRjb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786458671, "uuid": "b5e24fa2-ed03-465e-a3b6-50190e5a76e0", "value": 1028966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786458671, "uuid": "c4a6f5bd-3f23-4086-bcb0-f4e8cd79a507", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786458671, "uuid": "ae714431-e4bf-48e2-bf3a-8e2c312d7f12", "value": "comprobante de pago.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00e052dc-95bb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786476583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476583, "uuid": "d5e18363-4d6f-44ed-ad28-1290ba528929", "comment": "Malware payload (Vidar)", "value": "d0edf9b27509f8bd397aa42bc88128fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476583, "uuid": "c39e4ca6-2814-4433-82ef-d71b8b09a410", "comment": "Malware payload (Vidar)", "value": "a743287086d58bf80774951d50a0ad8ff93a841367e2f71b0e24c71336458536", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476583, "uuid": "bc4ac07d-360f-45e6-bc3f-8a8797940e1b", "comment": "Malware payload (Vidar)", "value": "ac3acb5c2da17ee91413630438e6a3f959aa871d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786476583, "uuid": "24c17659-2784-46c9-aa78-6737ac68525c", "comment": "Malware payload (Vidar)", "value": "d6c8e9796cb4aed01a8171f5e45104a941a830e8915cee5c0ea5207bc66ddc96c59551040512315eac789c80b8cb779b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476583, "uuid": "f6f2b33c-6b03-41ae-8a1e-40c2af4b8c0a", "value": "T155C68D17BD9049E5D499E33589B74291B630BC4C8B3533E72EA0BB782E723E19D36B41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476583, "uuid": "fafde400-e16a-4444-ac95-20c097946cb5", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476583, "uuid": "b9be9a3c-3458-41c6-b083-99b1c3104ea7", "value": "49152:nZQxplRa1Cf7pk8z0HeRC2QubYK3VUeup0turA+yR8VMHrc5i:noSmY1ubYKFUpaturAKY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786476583, "uuid": "5fe0540b-3de3-47c3-95b7-b04967c95362", "value": 12410208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786476583, "uuid": "11eb6969-c8f0-4a65-9d4b-dd042c29d3ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786476583, "uuid": "a9bb7fbf-3e34-489e-81cd-f33642c9315b", "value": "a743287086d58bf80774951d50a0ad8ff93a841367e2f71b0e24c71336458536.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcb15de3-9537-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786420312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786420312, "uuid": "ac7f0b1e-d812-4012-bbad-933b8b902e07", "comment": "Malware payload", "value": "654d91d830dd631b4d36a47b4bcde02b", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786420312, "uuid": "e9408266-d835-4097-b24d-6729ae6e5410", "comment": "Malware payload", "value": "a835f1601b2834fbeb9a3b4b3156d0d0e5ddeac3d9ca0500f5cbfe832d6958b4", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786420312, "uuid": "0461bc70-f23f-4692-a9e3-78751aedc480", "comment": "Malware payload", "value": "11bbdaa3a713425e99cc9f15f170c8cf09896e49", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786420312, "uuid": "6e82a0c7-a39f-413b-8788-898e8291f736", "comment": "Malware payload", "value": "ffac5ce59d8a19705f9f2fb669c210c203a98ab0aba79c5036d4891445ae88aafa6fd695f1b95b7a27878d51569b5eb8", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786420312, "uuid": "6e08e6dc-0e1f-466a-95cd-9a4f779250b2", "value": "T11903E92FB51B3421A872B3A43C71E2E6E557ED135E0B1CA4319CC0D56B227B463EAD9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786420312, "uuid": "3b2b8502-f498-4e7a-8e97-ce64601b59ab", "value": "768:M5J8ZjbbeRU8uAvI5J8ZjbbeRU8uAvWy5J8ZjbbeRU8uAvI5J8ZjbbeRU8uAvWAZ:MzUjnaUYQzUjnaUYeyzUjnaUYQzUjnaN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786420312, "uuid": "62df01ce-7a2f-4de5-998f-9956a6a5ed33", "value": 40653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786420312, "uuid": "4c04a23c-b764-411f-8967-dcdc201552ed", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786420312, "uuid": "e8164d39-7255-4e52-bc9c-50c214a88834", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9989f7ad-95c5-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786481134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786481134, "uuid": "9e35b812-f5e4-4a91-938f-e912a0514522", "comment": "Malware payload", "value": "0fb43d59563348d1a14c176fea262b6c", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Yogi", "colour": "#54A406", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786481134, "uuid": "7d12533e-4b56-4b72-8f96-63ea06a5e668", "comment": "Malware payload", "value": "a84f87d4e0bf73dd24e32e036997969a2a835087b98677d7820d09fcc9f1d0fc", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Yogi", "colour": "#54A406", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786481134, "uuid": "7ea89956-cf83-49d2-ba3e-1e0443593ad2", "comment": "Malware payload", "value": "e4c54b900c9dd6b210151bc35eeddda8bb028cf1", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Yogi", "colour": "#54A406", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786481134, "uuid": "9c7ce672-ba76-448c-a0ce-9d80d9c4fd7e", "comment": "Malware payload", "value": "b8b918a3198eca0dc44ed85336c420d3afdafa27d9347ccee4d83a89745fe92bdb0674ba8616789cb4df2d8756cfc415", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Yogi", "colour": "#54A406", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786481134, "uuid": "70839952-4dba-42b1-ae59-54e3dd7713ea", "value": "T183B633362963B69B33941F2D7B60D716FB6C481A884AEF895518A09D7C873F244CAFD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786481134, "uuid": "4bc9ce3a-0c65-4253-b091-dcda48add213", "value": "196608:3cufdfk5C+9jQDqJqbezcpSOWOQmX+k9ASymTgtjAZTZn3xlKyeX+yebNe:t9bNxzIOQmXd9pfTpH3xI+yeBe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786481134, "uuid": "2d3f2622-c286-4262-b185-a1cfc07696cf", "value": 10632290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786481134, "uuid": "5334859c-719b-4fdf-93b4-e9a3c3c052a8", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786481134, "uuid": "4876e401-8d29-448f-9d77-ea13a8e977f4", "value": "FVW_47179959.rev", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c9a1828-9562-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786438538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438538, "uuid": "5356fd0a-aaff-4f2f-a364-a77ffc6fa4bc", "comment": "Malware payload (AgentTesla)", "value": "34f3d8781c22a7f4ba1d72d7937ba743", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786438538, "uuid": "b8251f0a-6d4c-4e91-941c-d80ddd9b4c45", "comment": "Malware payload (AgentTesla)", "value": "a855977bf7e8b5596d381e2d7daa2389b4e268398591f1bb493142362640a5e7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "