{ "Event": { "published": true, "date": "2026-01-17", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-01-17", "timestamp": 1768694582, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "95a8c68e-9a87-4d81-a3ce-abc5b4c0c34b", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9987f6d-f3a6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768655892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768655892, "uuid": "5c53615d-5781-4444-837e-f1f659b78dc2", "comment": "Malware payload (Mirai)", "value": "5ce251597be959f60ea30df8a4e2f512", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768655892, "uuid": "1212b2dd-6e88-4a74-8dc4-07568f9ff98d", "comment": "Malware payload (Mirai)", "value": "002478a8c862b61bdc8de50401f88a3228f6013c07566aeb9e961f1189243c79", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768655892, "uuid": "caf9fc68-b310-4b3a-8e16-e36cb687562a", "comment": "Malware payload (Mirai)", "value": "862f0a48665bf5262199a2ff68e80a8a4363f243", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768655892, "uuid": "b2926c22-85cc-4305-a3f0-60588fd0dba0", "comment": "Malware payload (Mirai)", "value": "21966ea9d9a618ebc781db1d3eb49fd1720d2c768d3e7b2b15fa008564ac143752f627daf7c3fd0c17849a4fd58f27dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768655892, "uuid": "b61c22e4-4d2d-46c1-b632-d208ad1a141f", "value": "T122B36AA2CC756FD8C654E4B4B5B48F782B539A60518B1FBE156BC3B84047D8CF60A3B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768655892, "uuid": "880e5233-0d99-42f5-9292-8c4fa0501961", "value": "1536:p51aY73P1xaa75JlLiCPKfHUAEFV4zmxBpXW3l9I+i1eoQS:ljxN5JlWnf364zSZWVZi1jR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768655892, "uuid": "f9217321-b9e5-40cd-abdd-844659c0722c", "value": 117764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768655892, "uuid": "86a7ac23-b5b4-466a-956f-293ce681dbb7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768655892, "uuid": "08ac8f3a-c26d-4ffd-abcb-e8058ab4ee65", "value": "ub8ehJSePAfc9FYqZIT6.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd24ed1b-f374-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768634343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768634343, "uuid": "317b1e50-dc1c-471f-aa7b-4bf97ad48595", "comment": "Malware payload", "value": "40a9bc19ee9a4a052f92e35c76acdfe2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768634343, "uuid": "619413ad-1b0f-4354-8809-14ff7413551c", "comment": "Malware payload", "value": "01e0a45b8719e9571decb88aef9a0c46a70b34045818ab5074b1cc4a0065a40b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768634343, "uuid": "7a4f94e9-5d5e-41ac-95d3-7e32f0d062e3", "comment": "Malware payload", "value": "4913d58b177c1c33356fb0514c5e10e4f89b7599", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768634343, "uuid": "c24d332c-5e23-4c70-8379-c2e372e08ac2", "comment": "Malware payload", "value": "caf47c06733685b26a918b4559b870f2a1c18a9319575fc18582366f3693e3c5f6b4acb65075d2178fb79681250bca09", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768634343, "uuid": "9d9533ad-c88d-4ea9-92c6-7b3b3e5b07f1", "value": "T10CC31B44B982C0F5DC0B49B3E056B33FCB30EA3AD2629A50EFA44F56DB6790597162DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768634343, "uuid": "418c0a1c-9c79-4b2c-be40-773fe0e60a6d", "value": "3072:k2R6XPNqTYeYvhvj5AamdOKvYlzSCnELW9j:k2R61gZYvVryKELKj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768634343, "uuid": "03216c86-5245-4611-93b7-8cf79918469c", "value": 124484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768634343, "uuid": "b3f778ba-aed9-4b73-8bae-86c927326ca6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768634343, "uuid": "61ad52e9-81d3-4d42-89e8-4c8bf3b809e8", "value": "rondo.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa18a8a0-f3d0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768673932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768673932, "uuid": "53ed6cc0-94e1-4f96-aef5-5c1c7c32e622", "comment": "Malware payload (Mirai)", "value": "f5ff2bf10e3a005ed6ba4a2d87b050f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768673932, "uuid": "4f8d75f2-3c7f-437f-a840-a5bd2c99eecf", "comment": "Malware payload (Mirai)", "value": "08e9adfc682a88a8d6c4c7d7ef53a9fe1e679a500e1541636ba904a2dcebfef3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768673932, "uuid": "fb8a2217-51fd-47a1-8429-ec850dbe83b5", "comment": "Malware payload (Mirai)", "value": "3aa4af5ef8ba8d053a9017db44e1b0d86668f46e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768673932, "uuid": "b234fcbf-3073-4536-8f75-a9fb2f6c925b", "comment": "Malware payload (Mirai)", "value": "2b2960446eedf8cce04b7cca14bde7a2c3d8b54fc6a62e458f307ce10287e31f2a38cd7704f655cd69c5dd12f1da129b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768673932, "uuid": "d46342d6-b195-4426-b238-b8763c09dff0", "value": "T11A639E77D429AE94C24646F0F4B58EB51B93B48042DB0EFB1AD5C2B95083EACF5093F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768673932, "uuid": "0b88b258-d81f-4942-aba6-12acf6aae9b2", "value": "1536:vMwt3U3UsrIk7W650wSUKDSdzZLrNCrkMqHrfoa:vMlkmIk7350wsDyLrN1dLQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768673932, "uuid": "4bbe31c2-5314-43c3-80bc-394781fa0cfa", "value": 67060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768673932, "uuid": "6a98eaf4-3236-4d9c-a9be-059e07b5eb41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768673932, "uuid": "bba5272c-8e4d-48ba-a2f7-8ca70198450c", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae65ce4f-f3e8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768684113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768684113, "uuid": "582e445e-547f-4728-aef2-ad0cec2075e2", "comment": "Malware payload (Mirai)", "value": "205a24a568f5e8eab6c0fc73340ef14e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768684113, "uuid": "94ff00e9-973b-438b-96c5-428888f9cd3e", "comment": "Malware payload (Mirai)", "value": "094a10196a06c26e7d02316a2364cf2ee7a85266a0409b90f433fe77b8dacc9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768684113, "uuid": "5812406d-5544-44f3-a5dc-760a56e9df19", "comment": "Malware payload (Mirai)", "value": "5347e9ee1fe297ace12e037f06e57eaf98a7ff5b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768684113, "uuid": "bef3362f-feee-472c-b6a9-cf1309953819", "comment": "Malware payload (Mirai)", "value": "13c20f0fceccef7411edab28b7768a1fe1167c7fc80b98cc55b0ba8aaae9f358cf276208cac8d1efdd28b6710d2eed5a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768684113, "uuid": "19df896a-5363-4e44-bd11-ef54fd3a0ecf", "value": "T1385302282231A8D1A540EF33892E2449AF433F7473D971B24D04556977D9D07ABABF8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768684113, "uuid": "75613003-7db9-477c-9c23-2a70c1c7094e", "value": "1536:9Mem8KVkJmUt/Tg6YcSmYCGwtPvh69Msz9komkzUJqjdV46zs:9MepPmUM4KCtz6/zQkocjhg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768684113, "uuid": "fff8b8a5-8417-4495-9edc-bae1c38f6f20", "value": 65988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768684113, "uuid": "a2f4e188-a22f-487a-a7a6-d911a32fa20f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768684113, "uuid": "87f44189-9018-43ff-8889-9b920fd35aeb", "value": "Polar.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f96e45e5-f3d0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768673931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768673931, "uuid": "9897f74b-568a-4341-bfdd-a5d1d6590663", "comment": "Malware payload (Mirai)", "value": "bd226b7308f65696c1333f98732b5969", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768673931, "uuid": "12870629-366c-4df0-b1dd-fac4f938a048", "comment": "Malware payload (Mirai)", "value": "0d38d7d319146fb04174188bc27e502444973d8d05efc99645f0fcab67992326", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768673931, "uuid": "552b6962-45df-4555-8d8c-00d961555cfa", "comment": "Malware payload (Mirai)", "value": "a65c589d8a2e550e8d0835edc7cd5e364a91b550", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768673931, "uuid": "11ef8bce-0117-4ed9-b038-aa222e2eb602", "comment": "Malware payload (Mirai)", "value": "bf7986e6a1c2944ff359a5fa85564b4c601cc70ec00430d6f99d479348923a9c04d21d0344b56683ba9b92836e9cdb3a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768673931, "uuid": "3a918cfd-4f0f-47de-85ca-3529257dce86", "value": "T10F534AC4A643D4F9EE1605B11137F7335B32F8360129EE87C769D922AD63901AA5B39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768673931, "uuid": "05fd3a43-57ed-445c-9045-24db4ad8e1a9", "value": "1536:m3KLK6HGd0B8EchDK/m5BCz8VeVYY7D3SfEf+BBPetutlT3KSACcF:cK+IU0B8EchHPCwVmSsfOBmUt6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768673931, "uuid": "bb4351ac-09ac-4572-a5ee-5e91f9b9d248", "value": 63760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768673931, "uuid": "1c20db90-9811-4d96-99ed-f9fea0d71c03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768673931, "uuid": "cd8754d3-e126-40f4-98b0-1dc3a2dc34af", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "028b0ea7-f3c5-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1768668792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768668792, "uuid": "760d931e-3ea6-4594-b04e-29053546924b", "comment": "Malware payload (AgentTesla)", "value": "16cd50ac333473b1d4281b1cf4cf08a6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768668792, "uuid": "eb9c3579-5f5d-4603-8197-a4bd3870cb47", "comment": "Malware payload (AgentTesla)", "value": "0d6be9d127bb6bbd18e54ad70e9c60a2333c9d25b1a50f7ab7804c46fac00f04", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768668792, "uuid": "6f1c0c9e-68ef-4bb1-b5cf-a795fedca9be", "comment": "Malware payload (AgentTesla)", "value": "3bc79fa3066a68c7d10a8ac249b29a581df1a13c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768668792, "uuid": "7873b8ee-2cbb-409d-bab3-cfceb03944ad", "comment": "Malware payload (AgentTesla)", "value": "57a6e6e2de2dd2f56dce930610fdb2b18ab57ab746450e4df3103c93c805160ab09b997dec98e1f1b9ed6f70c3cad659", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768668792, "uuid": "f1e1f4d2-06f5-4e96-b998-a8fd9384772c", "value": "T14B941816EA50B4A5F88349702D79A216792D3D3A2680DD0BB78CDF563B71A83B0F531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768668792, "uuid": "d066d062-02d2-4cae-a0fe-cc78f15c8446", "value": "393196665d5b4439718fc90681c21f5d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768668792, "uuid": "31d3bc80-7b6e-4769-9f78-54a8b5705559", "value": "12288:JctfqJW/vZ8F6QgVoR3XfFBYTN7jvX19:YuW/aXLML", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768668792, "uuid": "75eeae1b-20da-47b1-8bc7-d467a8c3b011", "value": 413696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768668792, "uuid": "f7493765-adb1-4705-b494-671e831db224", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768668792, "uuid": "0d40c906-96a4-4dc3-8bda-48f6f3955bd7", "value": "PAGO A DATOS BANCARIOS (CONFIRMAR DATOS BANCARIOS)________pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cc7ba61-f3ca-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768671145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671145, "uuid": "2a9478c2-ee87-4b1f-875b-79967c0fd0e0", "comment": "Malware payload (Mirai)", "value": "1bac05a925d5fc67a4706993a4597f1d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671145, "uuid": "eb06dbdb-9224-47e3-a43b-4606838e6985", "comment": "Malware payload (Mirai)", "value": "0dee0dbf6634e611e93b416b890a7e1cf3c2bb82794702587e054e7df03b9858", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671145, "uuid": "8d2f33a2-c955-4670-9971-7e321859255c", "comment": "Malware payload (Mirai)", "value": "0355a36f877cb88e65705c1075898d84717a19c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671145, "uuid": "9f810762-4d1b-4167-8cc0-5066a26f79eb", "comment": "Malware payload (Mirai)", "value": "5179bdc77e511f394925d404503e4e41449f269979c5be21a116e85ad2ba05cb69553e30f57157bb366ac7d81c88ff45", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671145, "uuid": "3e9ad759-f387-4b4e-b8a9-cff87c486873", "value": "T194B3E84E6F318F7DFBA8C23447B3AA21975923D227E2C685D19CD6011E7028E645FBB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671145, "uuid": "ebe52b33-4b88-4053-b48a-a68598d46df6", "value": "1536:qEkWiTLiZECcpHOWWJDmjn5Pd1Oe4nfHLk1bgxur+E7OTeVutW/HeAB0901o6C:Yni50po8+/w1bggT7OTeEtW/c01o6C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768671145, "uuid": "59aee9dc-8735-44e7-87fd-147bf89dc5ae", "value": 117968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768671145, "uuid": "79ad0e8a-853b-43fc-a8c6-8fe4a22a80e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671145, "uuid": "1ef615af-1e7b-497e-aa65-d395aca81b1b", "value": "windy.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58ee2bd8-f3cb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768671514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671514, "uuid": "af3e468f-7db3-4c16-a10f-1f2583821d07", "comment": "Malware payload (Mirai)", "value": "2f0fb285e0e3a84e99f83862876c6903", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671514, "uuid": "85d84391-01f6-4a7e-8024-31404086d87e", "comment": "Malware payload (Mirai)", "value": "0ec7c3e799d5793fd77f64b6b7a7f1e0f94d83cb5da3ecbe1499072603f666dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671514, "uuid": "3521e303-75ed-4883-bd6e-7f8524d34ed2", "comment": "Malware payload (Mirai)", "value": "c044c7adea7c29f887f9323b0760d9005361d9c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671514, "uuid": "882879d4-79ad-4b0a-9994-fd6b261ac019", "comment": "Malware payload (Mirai)", "value": "6f5c961e72fa9861745e6c30887f88d2dd048b08fc2723bebf5d5646373f71ae3a422ee4741a1e7bdda53eafdb05b6d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671514, "uuid": "7eadfb53-29b4-4af8-84f2-9b85e7aced80", "value": "T1F1431885FDE2896AC6D0537AE62E368D3362B3A0D1CE3643CC684B1137C96CF5D66B50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671514, "uuid": "d110febc-c9a8-41f7-b497-a22f85656874", "value": "768:1A1EIQD7MB1hQ2Ogt1mpoNcNo9rK5udf//JcsqqAOr7zL5J4h6PhNl09TWnfKBz:Vg/QZ4nNcNbu3czqAOrr5J4kA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768671514, "uuid": "cde81471-13b7-42d1-8b92-3b800601d420", "value": 58984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768671514, "uuid": "6043606a-5262-410a-be4c-d20c8c8625a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671514, "uuid": "80fa43cf-f6e2-4c1c-9e4b-52313b40dd38", "value": "windy.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff7a2a42-f3ca-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768671364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671364, "uuid": "1ed8cc18-ff9f-45ab-8a49-20559ee9979e", "comment": "Malware payload (Mirai)", "value": "13c96ac9dd66232f319c7f5d244f4ef5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671364, "uuid": "68bd9db7-3b42-456a-8584-1d731f530e0a", "comment": "Malware payload (Mirai)", "value": "12126779e2a45f6ab1e609210b22ad99301dedc054b99ba0442a28bab25d0779", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671364, "uuid": "ef40298c-bdf7-4cd1-ad5a-7912cd5ab7ec", "comment": "Malware payload (Mirai)", "value": "237f622a4e3b5b69594ab2300d91e3cb0440d381", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671364, "uuid": "a4b88549-e7e8-44c3-8c32-ff7b8951c88c", "comment": "Malware payload (Mirai)", "value": "a3eef90891b5440c72151064df361ec3d35cade4aa46fe87ef3eb685526729bc038355b48d04865a39e0c95dc40ef265", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671364, "uuid": "f29f35d0-cbe1-417b-9d31-84c188cabb8b", "value": "T1B5B329D6F800DD7DF40ACA7A8463790AB530B3615AC31A27736BF963AC720E55827F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671364, "uuid": "cd41c752-578e-426d-9196-c7cc2493243e", "value": "3072:Pisy5flhR6AXAiAcrrht+hleD23VWsNwGdC6yqarLa:xy59hRBXAiP+Li2lW6k6yqWLa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768671364, "uuid": "9238df6e-52b5-4708-bc1d-55be90f1e31a", "value": 111660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768671364, "uuid": "09fae635-79b5-4db2-aa43-f0e01edd5f56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671364, "uuid": "6abac8ed-4b0a-4dd2-9314-a48a0d224fe1", "value": "windy.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d081846e-f348-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768615450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768615450, "uuid": "885e2c90-cce8-4b3f-81d0-b406ebc4c89e", "comment": "Malware payload", "value": "bd3f0be399f5cd7969b40575b53d4ebf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768615450, "uuid": "4bd7e723-bdd8-4e0d-bf9a-fcedc79f5a58", "comment": "Malware payload", "value": "14a921147e6fb768f5640d9048c0555d660965345e287adc20be966218e30170", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768615450, "uuid": "f9e42418-7957-4443-ac4f-2ae094af60a7", "comment": "Malware payload", "value": "6dc00ac64737944704450c404351d8d3f5d72aa6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768615450, "uuid": "5fb42c32-5a75-4ac5-ba67-665a596fd2f4", "comment": "Malware payload", "value": "d92bc3a6bff645a884ee568de7383e46ca51a1c8b1131d3a6dfeddf202b34c13b7b10c9842d4db48a10716b301b531b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768615450, "uuid": "720eaa3f-9073-442d-b53a-b24e1290e9d1", "value": "T1FAB37C03FA43D971D16E42F120720B3A0532E4B611058D51DBF5BA75ECEA882EBDB76D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768615450, "uuid": "387f9ef0-b4cb-4a51-a408-ee87ace3e015", "value": "1536:2Jr6RpDez2eOQ75LJgZMJ5phzCkYa6XbZFXvtBL3w1n+E7Z2RfxTpzUQioN9j:Wb2epKGpwk36LjLgp+E2pxTFUQT9j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768615450, "uuid": "2072eff9-89ce-497d-a4ee-2110c55dd9f0", "value": 114892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768615450, "uuid": "8057b1f3-cfc8-49d2-ad71-9fcf4a836689", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768615450, "uuid": "351a4755-64cf-411b-83de-9c4b8d3a9ca6", "value": "rondo.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50f7e0d4-f38e-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1768645301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768645301, "uuid": "233d9051-19f6-4b35-b560-52ea7d51dc9c", "comment": "Malware payload (ValleyRAT)", "value": "6098b42bcb2634407a69459429dd42ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768645301, "uuid": "b7fd4c23-0df2-468c-9f19-2394bf547f1e", "comment": "Malware payload (ValleyRAT)", "value": "151d1efff2d7867e50717283dbd72f965bccd893a5e3fe56c412c8c692bb06aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768645301, "uuid": "87b3a654-fc19-4fb3-ab14-996e9f1d739f", "comment": "Malware payload (ValleyRAT)", "value": "69847580e4f0376d9059e8f0b97763463035aac5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768645301, "uuid": "f4cb865f-2166-47f1-a237-c89741d73f31", "comment": "Malware payload (ValleyRAT)", "value": "dba19edd98669959d90ea9b549feb21b0a32c2eb2583278bc32e452faeb62255b541a58d994cb5098ee38e8a25fba857", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768645301, "uuid": "1d5b179e-a2fc-497a-b8e6-474cefc47c4b", "value": "T13D0833F377457A21D880FCF4DA8B31F845129916DBA1A9F4064632F48ABD76E12C378B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768645301, "uuid": "ca37611b-58e7-4074-a170-f531d9076bb7", "value": "039d1617d5f0788dacbd04b35a141ebe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768645301, "uuid": "4ac0721c-1fa0-4ce0-a10f-40607d0e028f", "value": "1572864:7v3cXeM8E4GBl6hMWZNchevLh95Nbfp9NGqv+Sj0+T:bEeM8vmwMWzccLhZbfDwSV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768645301, "uuid": "02cd6ef4-9666-4a54-81de-4ca96d29373b", "value": 77863539, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768645301, "uuid": "850659af-a4af-4718-9edc-ceb426026338", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768645301, "uuid": "b26987a4-8d1c-4b15-8b89-8627bf22d939", "value": "LetaVmP-64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "359e80df-f341-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768612184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612184, "uuid": "15f30e18-97a0-49a2-a6dc-3f7b0f32e6ac", "comment": "Malware payload (Mirai)", "value": "db6f41d06a2089d23578912bd80c375b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612184, "uuid": "9dcdef33-2302-4baa-b32e-df88c2c09be9", "comment": "Malware payload (Mirai)", "value": "1627eab18b9e096ad02a4dd8e0b1960a7a2064f38085b42689284b09a90bb33b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612184, "uuid": "7919d790-6e3f-463c-80e7-ec4d030c0825", "comment": "Malware payload (Mirai)", "value": "a44865eebd53d19f1c95d193816cd8beef5e72f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612184, "uuid": "47cfa9e5-29aa-4f58-8501-46554f985a41", "comment": "Malware payload (Mirai)", "value": "55f0d9e77aac3f2327bac326f888b1f8c1b3174e3216b9e821f52f4a6f906f81a90eccac7cecdcbdaf96b3cf67fad76f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768612184, "uuid": "fa2d36b3-c6dc-4544-a014-82cbf55332df", "value": "T157B39CDBF24702A0C8624AF007CB4BED3E2723815F27C5E72C6A657969791CF8905F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768612184, "uuid": "937d8eca-93ad-4f3b-810e-b97b978941b3", "value": "1536:Fu27gBY9FSSpj3z5Qxw6YaWWgg1Z/LWy:c9sSyzz36YaWWgg1Zq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768612184, "uuid": "c1ca26c8-5d22-4db9-9f23-1775e1451482", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768612184, "uuid": "f205c192-04c9-4465-b744-e3b96b08af16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768612184, "uuid": "eb45089e-711e-4d71-82bf-4c9bce815a93", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40ebb5d5-f3bc-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1768665031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768665031, "uuid": "4e404c45-621b-4cb2-93ac-2093ccb54dd8", "comment": "Malware payload (AsyncRAT)", "value": "a80f16eeb123f5f7a5c20b01e83b6edc", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768665031, "uuid": "a7a0ded8-9752-4f18-ab12-3f9cb835b415", "comment": "Malware payload (AsyncRAT)", "value": "16b3bc653718498665ca3db52e372f76d9496fe523bd293d84df984c39611eea", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768665031, "uuid": "0be016cb-955b-47a4-956a-1b3ed600cf85", "comment": "Malware payload (AsyncRAT)", "value": "19650a88b051c5e746ccf96eaa7011e2c1e9e1eb", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768665031, "uuid": "609e7049-f79f-4188-8f48-41173e80b36f", "comment": "Malware payload (AsyncRAT)", "value": "76de169dc8c6fecbfa4e8abe9ff091d325fce32ec261e2a124580799f995142d8fedb468e73c4018cdaa28165e4c71d0", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768665031, "uuid": "e1e95b0b-446d-4868-a561-0cac47806178", "value": "T1BAD22A04B7E48A65E1BC1BB98D7292009376E9474C67DB9E2FC440DE2623789CE14FF0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768665031, "uuid": "d23ecd6a-feb7-48a5-9053-f098cd5c511a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768665031, "uuid": "6eb9cb6b-af73-489b-b457-cd3828ba927f", "value": "384:eQXpodWMBtwfSSp+QKIcjdh93buUsTQxnCJf+jJGIjJbDoC/+:eGp3MB6SSsQK/jDRbVB/j2C/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768665031, "uuid": "0c0c9298-5246-4c51-b587-6ce96d3b29ed", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768665031, "uuid": "e1458e1b-3fac-49c5-a326-5a3a3b7231bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768665031, "uuid": "06cc87f9-be9f-4a1f-ad43-89e922c1b9ca", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeca8c34-f3dc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768678959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768678959, "uuid": "ac87ba8b-3147-4d1e-ac24-33968d2989a8", "comment": "Malware payload (Mirai)", "value": "21718e9d5558fa06a3d8626eb7097bc8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768678959, "uuid": "84a06bd2-4359-421f-9d6c-b505e7e6671e", "comment": "Malware payload (Mirai)", "value": "17992e6474b2562cb6fd78703570885d7253d93fa397c89fa617118afc491b76", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768678959, "uuid": "957120a1-d02c-4809-9401-9fda86b1d0d8", "comment": "Malware payload (Mirai)", "value": "681a243217e39744d9f6f5ffa208b7a4fd9ebd91", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768678959, "uuid": "862c42cc-872a-413c-a549-fd9b1b2beb85", "comment": "Malware payload (Mirai)", "value": "d32cff19c6d25bdcb103a4a72f3e5b04f7b3314ef3a99eaa2662b099f773b4205daf0caf79bc7abc73aca39ab254b17b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768678959, "uuid": "211a5037-7348-4d1a-ad27-66a5a6b035a7", "value": "T1CE730982B9D1961AC1C067BEA66F619D3361A3F1D2CE3103ECA70B11378716F0F26E95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768678959, "uuid": "5c681aae-ac05-4d9c-b466-b223394b1093", "value": "1536:o6+/KEp1JOCfOjttR2E9RWYFZkkddbLKI5wJH1wQVQdA4:J+/KK1QMtE9RWYxdIT3VQ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768678959, "uuid": "c9758924-ef15-4515-81cf-0ab721bd1e54", "value": 75256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768678959, "uuid": "bb61d1ec-4dc0-45b1-af9a-65068b0fd733", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768678959, "uuid": "e9960d47-f571-41b0-8966-609121cf0fce", "value": "Polar.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3652c25a-f341-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768612185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612185, "uuid": "45ee4be1-d04a-4bb5-aedd-ff09725a62c7", "comment": "Malware payload (Mirai)", "value": "b2d77896097050891393b8ed81467478", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612185, "uuid": "a6f6ba29-909f-4850-91d5-8684ad9c7434", "comment": "Malware payload (Mirai)", "value": "17f60e299aac3a851c611a9bc2734116e8a126c86ffd926044821271039ac514", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612185, "uuid": "0e7cce14-111b-4d76-ac96-dfb88fd63dc6", "comment": "Malware payload (Mirai)", "value": "f1b690720fb9d9cdb01a75f653b4e03e1578f960", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612185, "uuid": "50ee6e57-c8d2-4b96-b354-1eefda0a3290", "comment": "Malware payload (Mirai)", "value": "f7e575cce83b4735fb546de2641cc124689d715275e2dc54ff51c3b8b1d58bee121b1be63c8197056f8f83d3c05ad5b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768612185, "uuid": "84a37e74-6784-4185-ab54-645ffef1ef13", "value": "T136432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768612185, "uuid": "4d48f0d0-e184-4164-bd3a-ff4fd9ab31a9", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwW:RqtmZPuutfbltZFBSJsBcfDSTFI+BEW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768612185, "uuid": "803aeba7-f20b-411c-88a1-6c60e2861c53", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768612185, "uuid": "a1ca2431-622d-441f-a210-609053711736", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768612185, "uuid": "dfda1f95-c9f3-4dc2-be08-f2a5cf61d0bb", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "718359e7-f3a7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768656093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768656093, "uuid": "796689e5-5473-49c9-b1e2-84f36e06054c", "comment": "Malware payload (Mirai)", "value": "3fcdba8795c2669c2970679e83b62cff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768656093, "uuid": "1a045b48-59ca-4c44-8277-507df2ef3152", "comment": "Malware payload (Mirai)", "value": "186b4a4c114ca15deb8139082ef0da4aaa8da1f5851423d72973f7645f5730dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768656093, "uuid": "2693c646-9228-4f7a-a014-328775f2a84f", "comment": "Malware payload (Mirai)", "value": "e00132347999a7c4ac8772ef06b2ca8a9231ab0b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768656093, "uuid": "07095b21-8e28-4e46-95a0-b178ba010146", "comment": "Malware payload (Mirai)", "value": "29e7b93a2260dcf7ded025349569de05847a49afcc827a44fd9c7ca294d6a70d89bcf232fec8418fe4595886cb7cc417", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768656093, "uuid": "a55511e3-5e5f-4209-9f39-b09596cee9a6", "value": "T197330274D263A462D8A03E3357141ED6B379FBF2C1BD837D987DC36D38420A16EA9182", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768656093, "uuid": "452d9094-ff36-44b5-900c-25531a2ab630", "value": "1536:NGAqr4IjvXQGoH0FdkPtMlJIuCl4tWV1LP:GXDfoHWkOlJIuK4tWV1LP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768656093, "uuid": "fc5e0703-7782-42fa-b3d4-3e022b71edca", "value": 54660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768656093, "uuid": "9db4f02c-0b08-4969-816e-075ae58868ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768656093, "uuid": "3ca512a5-76a7-44bd-8d3e-1aa2a124b059", "value": "ub8ehJSePAfc9FYqZIT6.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b39cb65-f3ad-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768658713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768658713, "uuid": "c8c41ca0-47cf-4f06-ad1b-8e5c4aea73fb", "comment": "Malware payload", "value": "a0bb24a605b25deddbe242abdd8d999e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768658713, "uuid": "53c7d99c-487e-4eaf-ace2-5476ac9af8cf", "comment": "Malware payload", "value": "19dc0685c48f9015b6ddbf0db72ac3f204715d50e7282e2d95ca18f099a30b54", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768658713, "uuid": "ac9caf5a-1a9a-44c2-8d3e-5d6e4d53c683", "comment": "Malware payload", "value": "0963c8ee44356c4343fb1f3f3f54e6dbfbd0ce55", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768658713, "uuid": "9d238b66-f431-47ca-b853-889afce821ed", "comment": "Malware payload", "value": "a7d0965e7028c8a7e74787af1520eda714eb6f6fdf904a65d584c51ac804e92f9678c38631dfc5700e266c7ddaa2f68f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768658713, "uuid": "d438be49-9db4-448c-939e-b1771898b675", "value": "T1D286335B96F70B96D3A7F131C663B54DBB368288D0C90C726E180AD13283D772F6B651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768658713, "uuid": "35cb4463-8310-488b-bd36-e873dfddfef6", "value": "196608:+lExZJ8Ll5RjXdKfavvM0DKkHYcu5DWtwsaESrJXzpr:+lEvJIl5RjXdh30WIEW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768658713, "uuid": "4852977b-cd82-497b-b2f9-c25e8d91bbfb", "value": 8124796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768658713, "uuid": "fe238bef-059a-4d12-8052-ef97e9db1183", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768658713, "uuid": "9cfbd414-b33f-425a-b1b7-60472eda5cfa", "value": "node_modules.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed3504ef-f3a9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768657160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657160, "uuid": "472be706-a270-4be5-b302-f04bfccc7be3", "comment": "Malware payload", "value": "494a96635bd4e1c1db4b8245f4be0e90", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "windirautoupdates-top", "colour": "#5EA68C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657160, "uuid": "a1354a6d-b954-4bf2-80e1-3b96e3dd0855", "comment": "Malware payload", "value": "1a6af0334b88007940c2ae95d53f290bed28f92afe7e3b14d43f37f385fb51f9", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "windirautoupdates-top", "colour": "#5EA68C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657160, "uuid": "bc3b07d8-7b2d-4328-9d94-2d2294c35d51", "comment": "Malware payload", "value": "2a22d211a60b773bb19e612526de4b1ccc368051", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "windirautoupdates-top", "colour": "#5EA68C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657160, "uuid": "7a53d847-74fb-4cb4-b3f2-d53773e9a09e", "comment": "Malware payload", "value": "e30fa037d8a48e27200e4bba1d501e5921c7c7d4de982bee139137a80d11205c4280d7886af5d6e3ec05728e01f900ee", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "windirautoupdates-top", "colour": "#5EA68C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657160, "uuid": "64ac76a4-a45f-41b8-8f04-9335bb23bfb0", "value": "T1CBE6338E5F6BE54BF9440B72A3B08FE1079C5B25B642729CBD9F377A892B0D2C105853", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657160, "uuid": "1613091e-44b7-41a4-9631-1219fc7c97f5", "value": "393216:QgJMWX0/HtXDJyII4oRI5PLjy59H5GBCZalq5Aa1v4os:RGWX0vBDc4oe5jj4p5GBplq5Aad4o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768657160, "uuid": "d8265f3b-e6eb-4ec2-8a90-5e3748673458", "value": 14766080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768657160, "uuid": "6249c4bc-b2b1-4f11-a84d-773197e0010e", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657160, "uuid": "f4d6fac5-0f53-417a-9acc-1bcd1cd49682", "value": "Installer.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef93117e-f35c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768624093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768624093, "uuid": "29098782-75fa-4f60-8628-181dc593c39a", "comment": "Malware payload", "value": "1c0dde10dad1e1774f8566f6b08dfe2a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768624093, "uuid": "c6211083-5304-4b72-8237-1a5fdf61b3f0", "comment": "Malware payload", "value": "1bbf3836d0cb882ca79149ae940e4e3a191f78a08abdb9e250876dec45a8b053", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768624093, "uuid": "e652f3de-4126-4817-aa71-3b7f42a2aa8c", "comment": "Malware payload", "value": "f4b41d5eaa18c3778d4e343467cff45f4e84c18f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768624093, "uuid": "42ec19c8-7d84-44a0-ae3e-5ef728982947", "comment": "Malware payload", "value": "4bebe0bbe336aa3aa67f0092efbf38277e378a22ada66c7a4b8c5be4c6cb4489992bded6b7674f5cc17f7f2904cf65b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768624093, "uuid": "4ca85c81-8394-44bd-a3e9-12f3222494b0", "value": "T1D9D34D57770E0B47E29A09F0263B17D7C3EA5AD030E9EA45250AFF0982B5E365046FDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768624093, "uuid": "af168047-5d8e-42e9-8c3d-1dbaef823e61", "value": "1536:79Js6YVCjVgXsZi540WI8mW2v08YYlmf2q8QHQX6vN3A/rLPzDtIo5NrgpS:p+vCj+haDmXzYYGnO6y/r7e4ruS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768624093, "uuid": "27dd6fe8-33c6-47f3-a224-c50ca232f263", "value": 131120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768624093, "uuid": "f7535650-449d-44d7-9842-a20d2377e5c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768624093, "uuid": "9446c480-9edc-4541-920c-44713698b08e", "value": "rondo.powerpc-440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7381beaf-f3e1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768681007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768681007, "uuid": "0facfc72-7058-4a0d-a103-47fff20221dc", "comment": "Malware payload (Mirai)", "value": "83acf1f5b827e56cadbb8de8c42276c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768681007, "uuid": "4b24b5ea-aa7a-45a4-acff-6258159736a1", "comment": "Malware payload (Mirai)", "value": "1c72cb6c8c31e9c467706a0190f99717c165a8935b3a163778f172c2f6db6a99", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768681007, "uuid": "947f1c01-98ef-42aa-8f9d-a54df15ae28a", "comment": "Malware payload (Mirai)", "value": "34be8715bd5aece81ae0f7990eeab05b8177a7b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768681007, "uuid": "5af18f5b-0911-4b9f-9573-ee4372432ed1", "comment": "Malware payload (Mirai)", "value": "4f74a2b49904ba652f440cd7d44e35ba06f808be86071b0c669b783d132ab87770a67f0bace0052921b5c871cc8c0f4a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768681007, "uuid": "a32d255e-a711-47b0-9c03-1a99ff201b94", "value": "T1D3F38D62D8A4AF9CC2658570F021EE3C5B53DBA645831FBA19A7CB754043DCCFA067B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768681007, "uuid": "5d3f5ef2-d27b-4e2a-a789-d9fc52791cfc", "value": "3072:7GoFFUnee0PIM33yJckNI+Ata6IC7NjfW+i/UVHFC:7GKrr3oNI+ABB1O+xVHFC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768681007, "uuid": "ecd4c4da-ce6c-4924-a1f9-ad982bcbcbc9", "value": 157508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768681007, "uuid": "4650a126-cf7e-4775-94e7-7abc7f3ae377", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768681007, "uuid": "8a0cf7c3-1ee3-45c7-866d-288d1af55880", "value": "Polar.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec4dc2ee-f3cb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768671761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671761, "uuid": "77f96b8b-024d-4ee6-9cc7-a5bf0b07a83b", "comment": "Malware payload (Mirai)", "value": "b0fb2da231ac941525ed463dcdf7031d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671761, "uuid": "2beab157-9230-46c8-8159-6bfb42c8b66e", "comment": "Malware payload (Mirai)", "value": "1d5d32b66fc2bac297b4a721f41bd9a278d05ed974c08a75c79c33948fa3c038", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671761, "uuid": "fbc292dc-4b3f-403e-a47e-c3012abc6ff9", "comment": "Malware payload (Mirai)", "value": "4ac38b73ee80017e792c475a8b01e12278316606", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671761, "uuid": "0d827972-7ad5-4aac-8a9e-819b751daa5b", "comment": "Malware payload (Mirai)", "value": "27ae40b3b0063ace7a52ad633792dc4408af9bdda86f2fc90e43c95dd5aed1914d98210bdfc68dd0e88fa7b81e6788d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671761, "uuid": "a7562b63-ad6f-4f81-b58c-247d34e04ec0", "value": "T12D830A95B8814B22C5D412BAFA2E118D3313177CE3DE73129D206F25778B96F0E7BA16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671761, "uuid": "8f423599-e8ee-4352-877b-d8a3a8ad7a02", "value": "1536:4vn+KLcQS9m4cXvw6F593ccaW5KXsQDM4iU4nJ3pJ7835+Yid:wLdsoxz93ccaWm4nJ3pJg3Y1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768671761, "uuid": "dd448b70-d5ae-4fe2-8ca2-a94a49f3f48b", "value": 84356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768671761, "uuid": "c4d80fc5-e29c-4cdf-ac78-e3cc989de77b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671761, "uuid": "7153eeac-2096-4a83-ad91-03d60f1d7536", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef072547-f3a0-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1768653297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768653297, "uuid": "17d59cb2-de42-434a-a1ef-5838ebde8bb2", "comment": "Malware payload (Vidar)", "value": "de759b982cef6d8ddf704aa69feed9d4", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768653297, "uuid": "866e1750-0c25-4abd-a744-5930e55f1b94", "comment": "Malware payload (Vidar)", "value": "1dfa2c1bea7edf264025edadb578038fb9aaa43c27650451890dec4ada551e15", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768653297, "uuid": "4bed6372-5788-4fc4-9634-88100e02d01a", "comment": "Malware payload (Vidar)", "value": "eec08745550da9ea851eab88922a7be5d01d158b", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768653297, "uuid": "9fa1cbf3-752f-486e-a8f9-8f2a260f7eb0", "comment": "Malware payload (Vidar)", "value": "4d109461c83b569c7cb48752fb6d982c6e6c8379b8c3d2ce499996ede130e21321cce16736e55047316e2648c5683cdb", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768653297, "uuid": "d405cb28-ce68-4587-a9c1-f5165a77e371", "value": "T15B666D92BE448635C6DBF239E4B161866230F444073116E77B591BA64C6FBC8273FB2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768653297, "uuid": "9715ebbd-aed8-4119-b0a4-e62f492e07e2", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768653297, "uuid": "d0e61477-6fbf-4e1a-9d9a-adfbd65a1576", "value": "49152:ggKQDcKrb/THvO90d7HjmAFd4A64nsfJhuUsLtmDAwtJWCxe2jRhNrArs18CUV5v:YVItCNrArsq/VDwB5a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768653297, "uuid": "ae8ea247-f7e4-450c-93cb-04725961d72a", "value": 6531712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768653297, "uuid": "e2f701ea-6671-463d-90cc-a1e65302469c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768653297, "uuid": "0a31c834-b57d-4312-9905-89fb4a1bfe6d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "287b5fff-f3a9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768656830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768656830, "uuid": "6eb0056e-c908-46e9-aa10-f5254d0060a0", "comment": "Malware payload (Mirai)", "value": "78e3b0013a463beb441c3ba00e4a314a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768656830, "uuid": "10dae45f-67dc-4fab-8216-616188c2d3b5", "comment": "Malware payload (Mirai)", "value": "20c4caf24c5ccceae8fe74a53b74a9397aa05af415a4cde81d6e7987082a8c7a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768656830, "uuid": "0d454ca8-42dc-40a4-93aa-9678224d9773", "comment": "Malware payload (Mirai)", "value": "b52b5fc9bdb3de17a9d155f8c8136c6306c22b1e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768656830, "uuid": "a348f83c-c65a-4a1b-b514-281359ccffa4", "comment": "Malware payload (Mirai)", "value": "c1a5fcb3e365426ae6e0c25ff955f8c29c4cb1420f3ff492a5cc89bfba1556f7986af83ce3ebb0250309866852c07d0a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768656830, "uuid": "44c3db50-ae02-4956-9048-dcf1f5da9cea", "value": "T1B904E70AAFA11EBBD8AFDD3706A90A0238CC641721A53F767574D524F60E60F59E3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768656830, "uuid": "3cdc2d02-a562-40f7-8d11-66bf0827e0c5", "value": "3072:pxog98U/7G4aiQhrUbbTOotCzmoO0FmT:pxog98UjG4Yr4bTOapoO0I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768656830, "uuid": "b32db7ac-158f-4540-8911-5ab2de5095aa", "value": 179928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768656830, "uuid": "c82c8306-a9ab-4be8-8c06-cbd5a38a5eec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768656830, "uuid": "1e86c389-0774-4973-812c-66735351c344", "value": "ub8ehJSePAfc9FYqZIT6.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d42f9849-f3e2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768681599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768681599, "uuid": "fc4f5f7a-0605-4504-84f7-310bb7427d0b", "comment": "Malware payload (Mirai)", "value": "5bc895bf6c8e1ba5f6fe08d82d752cd1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768681599, "uuid": "77cabee4-2393-4341-b7f8-3e260318b7aa", "comment": "Malware payload (Mirai)", "value": "212b314cf46d30641138c55c90f537be908c0d889fe835c40cf6d779de90504e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768681599, "uuid": "9c9d7f65-3a2f-4beb-9c46-49e19b0ea002", "comment": "Malware payload (Mirai)", "value": "578829e061f6d422eefb0a7b3c8fef46fae9c254", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768681599, "uuid": "186a1d44-beb7-4ba6-8a39-f4b5825cc9d6", "comment": "Malware payload (Mirai)", "value": "700c5d513e198416f485235883d5784c7242740f266f9ae30820acdda7f533e4928c1f03394c27ebbd18a1e5132755cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768681599, "uuid": "275ce51e-0b81-4616-bd6b-60781f8bcea5", "value": "T103144ACBF800DDBDF81BE7764C530506B170B7B254924A377297796BE83A0A90927F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768681599, "uuid": "892dfafc-3a3c-4555-bf2a-5acfd832f97d", "value": "3072:I+OIqQjwVQe2LTTVwg2iZBYn1yL0aNyhWO5PMa29WTk+5VKjbiULnxo4Sex:oIqQqrCvV+1yLLNyhhPoCk+ALnx+ex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768681599, "uuid": "1e87343a-4fa1-4ef5-ad54-96b115c8d631", "value": 192320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768681599, "uuid": "538e51a8-0307-43a1-9761-540d12d6fbcc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768681599, "uuid": "4b5922cb-504f-4e2d-be84-8ee7fe6b46e2", "value": "Polar.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae75de50-f34d-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1768617541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768617541, "uuid": "1e90e884-cde4-4bf4-b182-515bf5085b41", "comment": "Malware payload (AsyncRAT)", "value": "4ccb6d5bb99830c0b6988bb7ca611636", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768617541, "uuid": "199c7140-83b9-445a-ad50-84d0a871a6f2", "comment": "Malware payload (AsyncRAT)", "value": "22319e513141209ea6f27af6fbfd41dc2cc39dc946ed8789ecacbf9fe0559298", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768617541, "uuid": "560731c5-619c-48e2-91b4-bff533ac7fa7", "comment": "Malware payload (AsyncRAT)", "value": "ea8311945a735fc674b52ff0e4125516fb67ac7b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768617541, "uuid": "f3142cfe-8de5-4529-bd11-88c3e317b65f", "comment": "Malware payload (AsyncRAT)", "value": "362dc646dda363634f3ac474d7467991beafafee66f866f444e2e18ae8439e52fe737c9b2ab91263b9f038a9d84d9dd9", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768617541, "uuid": "ef1e2e2f-3958-4d53-96f9-c6c565577bbf", "value": "T1AF231A143FE95226E2FE9F7D69F11545C6BAF6132602D34E1CC002DE4A23BC69A427F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768617541, "uuid": "8886959d-8f05-4ecc-a9b2-68391785bf2b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768617541, "uuid": "4f212790-8e97-482b-a22b-5d7d4b4e12b7", "value": "768:+seYPfoFMcveOB42fbLz6A5RyIvrY4Aeb1ngUptWIrAK8Rcc5rWBNnJR:uMcG2ffzNRb04xbuU33rvYce2JR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768617541, "uuid": "bccef8f1-3f76-4acd-b9a1-5de67efd789a", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768617541, "uuid": "24f3e442-c0e4-4169-8b1e-bde808296c93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768617541, "uuid": "b1172870-fa90-4a72-9706-1e03fb7f7414", "value": "gClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01edc19a-f3a9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768656765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768656765, "uuid": "7fef8cb4-9a18-4eea-81a5-1656d577d4c8", "comment": "Malware payload", "value": "47b8621b196b1b2cc6256c251da82dbb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768656765, "uuid": "719308ff-8ae3-4b16-8d69-04bc548795ec", "comment": "Malware payload", "value": "2239540813d28a42f9e185d50d25933987ff6ada453f22a71e5b8697816476e8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768656765, "uuid": "47faa0a5-594b-43d3-814d-2ba60d038ce1", "comment": "Malware payload", "value": "97fd9db7673346ba5b26cffa5aca70f78de81010", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768656765, "uuid": "ff19ab52-c30d-4c04-ba97-17bcddd4c008", "comment": "Malware payload", "value": "a3c5bfaa59e21452736532fdc027d9f4a1a5760303840c749488decebebb32321aab004a82080c59afa5fc2497cfa647", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768656765, "uuid": "3cda5b48-26a7-49e3-8637-356d18dfdc16", "value": "T1F0E5E570D78B06E5C4630DB2044AFB7F5A203F0EC618E276EED9F692F233526D699581", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768656765, "uuid": "14e78979-d26d-40fa-bfca-1efc9d796a2d", "value": "6fb5d0a2bd386abbc0984a18b0850a2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768656765, "uuid": "f9ace546-5208-4809-a6fc-d2bf72715d03", "value": "49152:9MvoUr2phJQfk2NGIrEW3W/nLMgP5glZdhAsXQ3plLcIv:96mphJQrErLMqEAVlLcIv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768656765, "uuid": "792e7470-7467-46c1-9686-966e542217b0", "value": 3264816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768656765, "uuid": "6bda7b73-f64e-425f-a7bd-a43e72101e2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768656765, "uuid": "4f277d9a-f940-41a1-a5f3-0ca99705a4cc", "value": "python36.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcc6559f-f3ca-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768671359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671359, "uuid": "b7500e3a-2693-47b8-82a6-f3089429303d", "comment": "Malware payload (Mirai)", "value": "e7c5ade6d88baad31efea009f9707d56", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671359, "uuid": "8072ac94-1362-4089-999f-a94eaa06083b", "comment": "Malware payload (Mirai)", "value": "22ddf478f36bcf8d8cbb761aa2b02e20337d35e5f4d3d039233c369af572f1ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671359, "uuid": "c4bb65ad-2187-434a-98eb-e101258756be", "comment": "Malware payload (Mirai)", "value": "e655891a3e2cff783cae5aba6319343515d04eb6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671359, "uuid": "2b9b7a6c-19a5-429d-b943-f8db0abc3ab3", "comment": "Malware payload (Mirai)", "value": "532d6f7dc7db32021eba60c0cf4fb742c3b0cc2fe7cec54c90bab7ea3188bf4d42c27db812736a4311d4d2dcd6b6cebd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671359, "uuid": "6a669bea-5545-48d1-9ba2-e9efdf3fd4ab", "value": "T19D73122B5571F970C0E35DB68236238122064BB7ACAB213755127478ADDE31F3EF269B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671359, "uuid": "dc7e9cf3-e493-43d5-aca0-e204b07f92ed", "value": "1536:d4iyzCD7IMk4GvBv9WDSzoQ0YR3suLmTxjkSJNHbCLQUsgKFC2:ouDEMhu1ES7scmTxjPJNHuLjsbU2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768671359, "uuid": "8f1b6e95-cf51-475a-88de-8fc4baf322a0", "value": 74416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768671359, "uuid": "1583702a-f4d0-4cd8-b254-1d2d7a97974b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671359, "uuid": "0bb98d79-fa0d-4fde-8c40-1a5983c453d4", "value": "windy.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ab9989d-f3aa-11f0-a129-42010a9c0007", "comment": "Malware payload (LummaStealer)", "timestamp": 1768657317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657317, "uuid": "d4b985c4-0caf-43b0-9e3f-59b42bd35b75", "comment": "Malware payload (LummaStealer)", "value": "a88da6828b5a0cc39b962f694d17f494", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-3585", "colour": "#CDA8D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657317, "uuid": "6ec24504-cdb6-4317-a284-115a2ca00ab0", "comment": "Malware payload (LummaStealer)", "value": "23288b0b5edd419edbb2ac73131f5b60a40f071e847982dfe52f11285fe6bc12", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-3585", "colour": "#CDA8D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657317, "uuid": "77e328bf-a1ff-4e51-8bb4-6ce381b72972", "comment": "Malware payload (LummaStealer)", "value": "372e4541ccc3cbe34046cfc582782dee1bcad95f", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-3585", "colour": "#CDA8D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657317, "uuid": "62120e04-f5c3-4570-aa76-779faaeb91d3", "comment": "Malware payload (LummaStealer)", "value": "4f229dd7bd8db4757bcd26032a1453cefff17e66906dd5ae7aa3096f7986a385e498c1e07d4a38c3253de1bc780ece81", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-3585", "colour": "#CDA8D1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657317, "uuid": "74a9fe9f-5309-4a39-9bbc-531687645524", "value": "T146E633B1DED2105A770C235CEFB35597C870389A02D6EC1654AE7432E6DE340EAF2B66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657317, "uuid": "0b95b72b-5f56-4c1d-bba5-d0e15602c87b", "value": "393216:AszFaarY5KEKeRrwJO60wo4tg+U9XDpgxe1GlOdIXBNOJ7y:AuFaEY8jeGHpo4tyXtgxeIlOeXoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768657317, "uuid": "25dbe830-9463-40c3-ae4b-834ebe879be9", "value": 14679731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768657317, "uuid": "359b461d-d955-41a8-bc4e-a979159cfeba", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657317, "uuid": "a403f4de-987b-455b-8477-c5fc6c4b5ffa", "value": "cx-programmer 9.1 free download Full.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7f2dc39-f3b2-11f0-a129-42010a9c0007", "comment": "Malware payload (ACRStealer)", "timestamp": 1768661016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768661016, "uuid": "37f44ada-236a-4477-8041-6ac6492972c8", "comment": "Malware payload (ACRStealer)", "value": "4c4ff0a9fd923afbf5bd9792d0a08623", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768661016, "uuid": "bc535ddf-c315-442b-a802-40ba46dfec32", "comment": "Malware payload (ACRStealer)", "value": "2405e5f49fb7c0c6e7d3da331e99d1dd7ccd9fb0982bd66617351aa475370bb0", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768661016, "uuid": "6459c665-d978-47b7-bb70-6c789ccb7748", "comment": "Malware payload (ACRStealer)", "value": "a173ff2bc8479efe361188f2a854bf622f3147df", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768661016, "uuid": "198776df-48d2-4afb-af7c-87b46e9eb726", "comment": "Malware payload (ACRStealer)", "value": "7809aca4f8a74877e9a4fa046dff2fa45c07b6e19716a50f13070f628bb5290ef7d4e3f5bc02181fa42877dfa0d0cd10", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768661016, "uuid": "20b55d7e-8b97-4a27-9707-066cc7630fda", "value": "T1A6873314EA9D421AD3C7DEFBF845A35E9CA2C80AA702F52FE65821001D479F24B4F75B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768661016, "uuid": "d19eb469-d64c-4a28-a11a-47c4690d3462", "value": "786432:fTNSOOXNiPOzs79HAVwPu4yU8y7orScPf/Fke1l72pxjOdIv2m:fJQXNiAagVKdTEPK849O2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768661016, "uuid": "756e055e-cce1-44cd-b1bd-4b0622a1f3a7", "value": 37882279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768661016, "uuid": "9cc61322-b6d0-48cc-9d80-81fe1ad057d7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768661016, "uuid": "601644c4-37d2-4931-8a79-b691d78c0bd7", "value": "#Pa$$w0rD__2025--0pe\u0274_Set-Up!.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a468e2a-f3c9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768670630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768670630, "uuid": "d79d53fe-b26c-48d3-abfc-cb7a909ac27f", "comment": "Malware payload (Mirai)", "value": "badab99d209169193b4c2770123f402a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768670630, "uuid": "13c77b90-69e3-4704-b0f7-4942441e2207", "comment": "Malware payload (Mirai)", "value": "245145f7abf0a67ca793abd5fa712516b69b5643d9e6602c08115f33243b2223", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768670630, "uuid": "96dd461d-927e-4cf5-8eb9-05d0dc20d731", "comment": "Malware payload (Mirai)", "value": "fad723094e03ee1286338d7c5688c4e2c55f037d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768670630, "uuid": "3255605d-ba44-4f9a-ae33-42f16183f7e2", "comment": "Malware payload (Mirai)", "value": "098ba47ac8f9e191491417acb7386f7d602a816bece39924025267044672b07f1b6a5dcb7b14ee1f53fc0b52c99664de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768670630, "uuid": "8ea2499d-7832-4382-8fa9-81e9649a5fd9", "value": "T15D634A356D7A2E27C1C0A43E22B74764B2F15B8E3AE8CA1E7D720E4EFF50A5060175B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768670630, "uuid": "a538db23-1a49-4e0a-abe6-908e7114ed53", "value": "1536:RBD9h3VSfHUB5HdShZsCRBlLkAnDzzBzl1Nu:/j8hF/qwBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768670630, "uuid": "07c8e510-de69-4801-8143-8458b201e20c", "value": 72784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768670630, "uuid": "150e3d2e-53ee-47f2-b9b3-12aabcafc5b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768670630, "uuid": "f0a90039-205c-4be8-a86f-b561735e0ca3", "value": "vcimanagement.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e1722f5-f3c9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768670637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768670637, "uuid": "cd661eef-ec86-47dc-a25f-e468b7b566b6", "comment": "Malware payload (Mirai)", "value": "61169a73fcd40715e1d3027d59a8ff5d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768670637, "uuid": "166258ae-b53d-4438-a540-dd55e776a526", "comment": "Malware payload (Mirai)", "value": "252f827689c679dc51572c1dd9c4ce02c26603970008689e9d868d1be3f80c82", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768670637, "uuid": "090f505c-e8a9-4ede-a4e7-12ece3c8a444", "comment": "Malware payload (Mirai)", "value": "3236c60fa8d69c483b810afca44036b40b6acd20", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768670637, "uuid": "d93d8a43-6d13-4d80-89ef-1c94ab6af6e9", "comment": "Malware payload (Mirai)", "value": "22d3eee520d09f7bdad64e7b574b4328fec6d0f4034913f6099355a71461c1b49f8cba36dfcc551d68fa9d2852280565", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768670637, "uuid": "0846b3db-09aa-4e73-86c0-75dc04eed03c", "value": "T12233E85279C26A16C2E0637AF96E81CE332177E8D1DF325BCC211B0476D651F0DA3B52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768670637, "uuid": "e28cba3c-27eb-4d2a-a813-0448eda124e3", "value": "1536:5g2uZQ1i3UgyHpVKKaxgDg60UsHHHgId2Zoh+fg57p:STZWsnPd2mhAQp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768670637, "uuid": "9bdb2941-c8d3-4a63-b49b-4432e287f78c", "value": 52140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768670637, "uuid": "7f4f62e2-2204-4fbe-8fd2-518b47734bcd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768670637, "uuid": "54d4f2f9-c149-44b7-95fa-3a327df6d2fe", "value": "vcimanagement.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b3ffa07-f3ab-11f0-a129-42010a9c0007", "comment": "Malware payload (Efimer)", "timestamp": 1768657667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657667, "uuid": "a0bbc2e4-c4d1-4a8e-b3d9-46d7324e7201", "comment": "Malware payload (Efimer)", "value": "c6b57c1a542df2b093b280bc12da8409", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657667, "uuid": "9ba131a0-8950-40b3-ae50-a5c5b171185b", "comment": "Malware payload (Efimer)", "value": "25d15d110a5dba9a673371328b0b625ffeeab64baa284db0c02609c3a448427b", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657667, "uuid": "ebfaa85a-d8d8-4d59-9265-4a78c122346b", "comment": "Malware payload (Efimer)", "value": "55e740afb223f790ee628024e8cce5e15f6bedfb", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657667, "uuid": "f1c5ecff-60d1-4a42-aa83-bdd00c226b47", "comment": "Malware payload (Efimer)", "value": "4047e51ea925e3fb0b3e00254aad4fe6e585e868ae631cde4406cb112c1ee36fff8eea12477118b2a4ab9bf3fec17aa4", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657667, "uuid": "ce8e727d-dabe-476b-a92f-ef161a6e7b32", "value": "T16DD6335C66D102EEFCA3017CEFE22691E558B8660731C5EF87A847A6AD231E04D3D763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657667, "uuid": "fd9efe57-9090-4d41-84ed-05969577961f", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657667, "uuid": "84d3a214-66c1-4179-8dff-ea3b432c1d6e", "value": "393216:1/21lnqv3lj9aEqvD2hXMCHWUjzcuI3/PkuUS:1/21lnqvBcEqvKhXMb8wH/sC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768657667, "uuid": "91760241-6169-4294-9791-fb6dfd8c3377", "value": 12768411, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768657667, "uuid": "3ecbd60d-5b15-4001-ad1d-cc6b144e6913", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657667, "uuid": "e3224de6-9e80-4dc4-85d1-4f3e01040248", "value": "zinfoz.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "371e7e17-f341-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768612187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612187, "uuid": "32aea20a-4cf6-4914-b9a3-5c28c066634e", "comment": "Malware payload (Mirai)", "value": "5839c9918ebe501158575352f962d840", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612187, "uuid": "e08d50fc-ca40-4c33-ae72-22814d2768d4", "comment": "Malware payload (Mirai)", "value": "27c078d7e77c4153144bedccc55cb25e0ebd9fc384a58b0aa6c068be74ff0f65", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612187, "uuid": "bd6c4673-a1c3-4b55-b63b-412e348ca10a", "comment": "Malware payload (Mirai)", "value": "25edf207756f655b6e7e7a5852d676207a702ab7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612187, "uuid": "23e74c41-d07d-4b14-af53-aa5e3c6e84de", "comment": "Malware payload (Mirai)", "value": "654452f05c0954e88ff0950b6c99254134d40a0d893845793741077f41556e1d62b9ce85c80899e9f1765f43807ff705", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768612187, "uuid": "5eafa226-ab73-45e4-9448-57453c49e141", "value": "T1A0A2D11572A32D56F3AC1C3DC5AEC327F9661BFCC0F532B569405620C94D24A3E39A4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768612187, "uuid": "a80155fc-08cb-4da9-95a2-164612941c67", "value": "384:UvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxj1hymdGUop5h9:UvQn4j+ZO5fKAlxJs3UozP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768612187, "uuid": "e23d0484-9d3f-4022-977a-32d68591b5fa", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768612187, "uuid": "034c99da-1b3b-4fd3-92ec-df8caa36f8fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768612187, "uuid": "0fc7122b-d436-4f3f-9de5-5c2fee33d021", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10929119-f3d9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768677405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768677405, "uuid": "bc790a68-b821-4140-89e7-651f1d897259", "comment": "Malware payload (Mirai)", "value": "a0d7b3a2faa7964aebdbaf1e8b2813ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768677405, "uuid": "133a22ee-c5fe-4b1d-8d12-8112649c06a5", "comment": "Malware payload (Mirai)", "value": "28f463829facf79a507c6521a7e9917c90f9c9cfe67251a7f35fb067894325a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768677405, "uuid": "dce61ac8-e5a2-45d4-9cb3-4038bf00aecc", "comment": "Malware payload (Mirai)", "value": "25bd431c76f2c8e59dc02aef8ce101450c04ced0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768677405, "uuid": "34410790-5efc-4420-8d94-9cc359c1ef66", "comment": "Malware payload (Mirai)", "value": "678f5d704add8cdc922eaa6946600626591002a3011d24251eb99792f65ebb78402e64d9a33b9a4ff9b45a2dacd2e1dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768677405, "uuid": "056230ac-3d11-4ba5-85eb-76bc9d9bde71", "value": "T1C743F2F59166C642C0D4AD3E29A63D0F4128FA1594ACD3EAEFD03164352E3DE397AAC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768677405, "uuid": "dc86d326-b117-4d74-a173-f97db61ffccd", "value": "1536:XsWkiKoqvLOJQbeJxvf/euuH4IFWHVwn/AAylnouy8tyssS:8W0iQbeJxvfdefFwiAAy9outBB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768677405, "uuid": "2d1f65bc-2954-4d09-9dbe-49a35ee0d1d0", "value": 58068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768677405, "uuid": "e3adaff1-6477-491e-82da-63c8ca5a8602", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768677405, "uuid": "5226b622-233a-4463-b6e4-7c3f76755a39", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed102907-f3cb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768671762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671762, "uuid": "fe747ed4-62d0-4e1d-ad3d-38f095a4e436", "comment": "Malware payload (Mirai)", "value": "ce4b469aab7044392de6576f41947336", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671762, "uuid": "466943e6-fc3c-4688-82a4-484f20bc2493", "comment": "Malware payload (Mirai)", "value": "2b269823dacab4362a87ac5ec2bf507723d1b2836784bfc9a0f2c3ec7063eded", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671762, "uuid": "f62f4ca0-479d-4c6f-86c7-30b6a2752f93", "comment": "Malware payload (Mirai)", "value": "db96c82aa0c0babfaa0873472ceb2a45b7f3da70", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671762, "uuid": "07006a9f-7a3d-4e90-a9d8-76713771a7dc", "comment": "Malware payload (Mirai)", "value": "eb05bd8072b205f16c53b813bd0525a444f0b9420805ffbf3095519e1e299f7a8d43cf3642c7e0a6bbd4413b4b225c49", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671762, "uuid": "097b73a7-d477-4a34-8a9d-e8fad16afe29", "value": "T1E8732B81B8815623C6D412BBFB6F428D372653A8E2EF7207CD266F21378785B0E77651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671762, "uuid": "17af9e35-57b8-497f-8bc6-951f3069b1b1", "value": "1536:v7fUTYvUGm9M9127t/YzIRSmD8tOQuRcdt/+WRYvPo:v7fwx42TRS+LQ2g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768671762, "uuid": "891b0bbf-f560-4373-b684-bd5727e548c4", "value": 79336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768671762, "uuid": "5be86811-4f30-429f-86e7-e0777ec79898", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671762, "uuid": "9f0ed82b-f91b-4181-829c-f5809178ac27", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "140b368b-f37d-11f0-a129-42010a9c0007", "comment": "Malware payload (RondoDox)", "timestamp": 1768637898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768637898, "uuid": "c5871c56-aec4-4bb5-a449-9dec23d26be2", "comment": "Malware payload (RondoDox)", "value": "8f8609ec2f38f29dbeba6b30b855e117", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "RondoDox", "colour": "#4E0F4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768637898, "uuid": "5764a054-c4b8-4e47-911a-fced66b0ece4", "comment": "Malware payload (RondoDox)", "value": "2d6cb85fb16a5fa70f9fe9478f6ed924280b74846f12686912105891fac17959", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "RondoDox", "colour": "#4E0F4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768637898, "uuid": "0b041ae9-82f3-45a6-905b-1b9971e1033d", "comment": "Malware payload (RondoDox)", "value": "b1ef882a63ee953f8cb1262c0702a0cd7fd2ce95", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "RondoDox", "colour": "#4E0F4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768637898, "uuid": "a5d9ac3b-7801-4886-9b90-99f87d8d6d3e", "comment": "Malware payload (RondoDox)", "value": "af11a7dc2e6faf637b7750e0589e46b94a8cee70ad53fb091b89e8af868917061ee8552f212b8ba41bd7871c3ae1cc16", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "RondoDox", "colour": "#4E0F4E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768637898, "uuid": "604f0e19-43ef-48aa-9db2-e1919364b3dc", "value": "T123E3296AEC819F55D8D526FBFA5E8189335307B8E3EA3112DE244F2513CA92B0F7B405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768637898, "uuid": "6b305ea9-fec1-4986-b81b-5e603b55cb34", "value": "3072:afPw6ULUox7EvSvBa59M/tZ/LAB/zKUitsntaDj:kw6ULUo5iSBarM/tZcBeUostej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768637898, "uuid": "02ed84ff-de9d-4689-bdf6-b951f252b40d", "value": 147028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768637898, "uuid": "ce89a957-5044-470f-aebe-410b791a86a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768637898, "uuid": "9711b787-06e3-454a-bf47-d05120ab84c0", "value": "rondo.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbf87c73-f3ca-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768671358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671358, "uuid": "a969594f-690a-4396-bf89-c5717b57639b", "comment": "Malware payload (Mirai)", "value": "f813cedc88a82736e09e325b8572986a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671358, "uuid": "2aebdd98-07ed-4390-b92a-1480b8c20df8", "comment": "Malware payload (Mirai)", "value": "2e86b78e7cdb348dc97c0b2c7e95d55721b7dfdf723b9e0386a784e1940e9d80", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671358, "uuid": "f316e93b-0382-4c90-800c-b9c6e203ff03", "comment": "Malware payload (Mirai)", "value": "4b4c9ef4da4c5a70172acc00fc8a835f1814c75d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671358, "uuid": "b0388682-3dea-4eb4-a5d6-c9a2a22c9f8d", "comment": "Malware payload (Mirai)", "value": "4ef81f039cdb96a323af4d01176df24c1ef8c4862d0e3cafe72f16bc807a9d0ae5a981132a8db101eae630f8c0a05155", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671358, "uuid": "8c7a49bc-cff2-4eb4-bd36-f6c1f96f3105", "value": "T1D8938D63C8651D98C16986B9B5A0BE365733F94051D72FFA1296CB3A9083ECCF9093F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671358, "uuid": "2c089896-7986-4a42-9663-82c17d12b8ce", "value": "1536:n/yL00i8w54YdbYWaMp7Kohpl7rRZ4MxCHPb5pQ5pYO:n6L0h6YWMp+oJpZ4MxygrYO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768671358, "uuid": "42298d9f-c336-418f-a71a-32e3c6bce9d9", "value": 91708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768671358, "uuid": "a639f3af-cb2d-461b-bbfa-fa7971964aef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671358, "uuid": "ca00e492-94bc-4325-adcc-284e36d1d1c3", "value": "windy.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77c8861a-f3ca-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768671136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671136, "uuid": "d51aca1d-cf32-410a-8d75-1fb0e31f8eb2", "comment": "Malware payload (Mirai)", "value": "badbdc910730c4201e5d3945ea12d1c5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671136, "uuid": "b0baeedb-11d0-45f5-b392-daf18af481fd", "comment": "Malware payload (Mirai)", "value": "301636ccf6dcc9ec6b4b6ba794053c9d5a1556fd94f5ee35fac0b3ddcf009315", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671136, "uuid": "eae73eec-13f6-4960-a15e-3bc71e64d48f", "comment": "Malware payload (Mirai)", "value": "8ea866060ef937d354b5ecf2d065a1304e5c3461", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671136, "uuid": "1282920e-bb35-46ed-a88e-cac85e760aac", "comment": "Malware payload (Mirai)", "value": "f516300ec3da54ba2e4eda6b0f5e1be1bf5f2e625956aefff57059a4604bc08d964aefd9b9ffdf5683d9d04a83edc0c2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671136, "uuid": "92c6f316-7c2c-4189-b573-e7ecfeb3b2c9", "value": "T15C616DE9218212F53CB5CF6362AD4618328384B669DF7F46F5ED78E980ACE56F043742", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671136, "uuid": "e87a9570-449a-4488-a187-40cd05cf6b44", "value": "24:Iti040Xsi0x0mi0a08i0l0ATi0f01si0D0Ki0qp0qnJi0g0kLi070s1Li0kp0kNi:iyHsr5RARJCdLuJrR3kLaNY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768671136, "uuid": "663584d3-b8dc-4c89-bc8f-83de2bb93b9f", "value": 3224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768671136, "uuid": "3b72bd48-5104-4872-9679-24d88371323f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671136, "uuid": "682ee4c3-f443-4a24-bd78-bc5f8e276276", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb339bfc-f3ca-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768671357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671357, "uuid": "d1a46286-6356-416a-8cbd-150581e4da0a", "comment": "Malware payload (Mirai)", "value": "3ec8f11ebab60f091d0f5ad4765975db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671357, "uuid": "930ce273-2bc1-4e91-b784-95464a82537c", "comment": "Malware payload (Mirai)", "value": "30368e4033ac899b6e2604ccd002bc0f1cd906c7ec310f7460337b561312bd35", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671357, "uuid": "33524fcc-374d-4291-9dd0-9f14021fc8c3", "comment": "Malware payload (Mirai)", "value": "b6f0621f36abb4dc3bec9164013c1ce7a9c38741", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671357, "uuid": "affea573-625c-4f4f-be5e-6932340498b8", "comment": "Malware payload (Mirai)", "value": "4c0c625ed6189733c03a3f1988486bbb0b04fbf466df3efbdba01fe6c8f526f9874fc59dee96df7e60c613b073e15411", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671357, "uuid": "80b6ec52-763d-4b04-adcd-206c7b234b6e", "value": "T12A330262395DAE36D1343AF1EC5BC8C45DE972AA88FB3E5056100B78F47E6D606BC1C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671357, "uuid": "0c4a9141-378c-4b72-89f9-8c43b8fc0bd3", "value": "1536:h/yhwdM3tdtbHsnDAn4/SovYIqsUa6DsqNLs:h/UdeAn4/KIqszULs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768671357, "uuid": "b820830c-3780-4bdc-88dd-d2b20ef70a91", "value": 50744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768671357, "uuid": "fccd6548-cc9c-4517-bac8-5fa49c65e458", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671357, "uuid": "cf91a578-9a4b-4243-a572-7fcc9b57c55e", "value": "windy.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6ef9d44-f3b1-11f0-a129-42010a9c0007", "comment": "Malware payload (ACRStealer)", "timestamp": 1768660478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768660478, "uuid": "b3b0b7b0-9efa-4b23-a51d-25ef3760d4af", "comment": "Malware payload (ACRStealer)", "value": "0455680e24fddef6db31acbae644237d", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768660478, "uuid": "765fa3d7-3fdf-46cd-86d0-6feef2df9b10", "comment": "Malware payload (ACRStealer)", "value": "3059dea571ebf0e89dadebf1aaa48ed4f7584ce4844d75fec7e97ab4bc6f6c53", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768660478, "uuid": "07b34dd5-a098-44d6-93a0-909c39506e7e", "comment": "Malware payload (ACRStealer)", "value": "f6bad037f31ae9af0f4e728e207f26d0042e8f64", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768660478, "uuid": "a65ff2a1-d795-4190-b88e-7470dbc5c324", "comment": "Malware payload (ACRStealer)", "value": "8caea4f5f72c810b3cb5f362c70447e5a801456c43116becb737a17c5e9f87a7644c3b2fe318b87568047eb6fe21a00a", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768660478, "uuid": "d7b49929-3853-4ed0-972e-81dba2d695c9", "value": "T1A8A7336DEA8D2685D7ABDDF6D886539DA531C002CB72FA2FC9A000410C997FB0B1F657", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768660478, "uuid": "6f182bbc-39dc-4d74-bc6c-b2eb1e1d81a3", "value": "786432:hyRFuJag/OE9xRX2OFtCE6WA/T7AFoJ7UPGBsXWb4rh465pPCNV1dgcK+Q2fciNp:hyuJ0CH2OFkLmoaPGKXWb47PPCdHKL2B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768660478, "uuid": "6a4d2299-4ce1-4638-8cc4-97ab1b3feb52", "value": 47190657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768660478, "uuid": "70d280cb-f1e2-4f78-8618-0c85a84f0e19", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768660478, "uuid": "c687d142-0383-41ae-8ae0-c4e1c9835501", "value": "#Pa$$w0rD__2025--0pe\u0274_Set-Up!.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a41c6723-f3df-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768680230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768680230, "uuid": "24c5c78a-e6fe-4adb-984b-8393a7196005", "comment": "Malware payload", "value": "e8656d8edab542bd11bc333285a28ebd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768680230, "uuid": "4f7c708f-3d8a-497d-9844-7ae76bf939b6", "comment": "Malware payload", "value": "31f7d9d678622849ed3d7610d95e29efd633f49b15ed19093358fbb752d78a88", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768680230, "uuid": "f955d1ec-22f4-4d9f-9682-2d226b971aaa", "comment": "Malware payload", "value": "8ff1a15087dbd9ba099f66271b1c5f08f73cfc93", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768680230, "uuid": "438be915-c791-4f6c-a87a-e6e113a17cb2", "comment": "Malware payload", "value": "f29f47b7b72927dfc0fbc42477b185eec2b437c8bde954459f84c8db3c291c9c011d6dcf33b97e51642872f5bb65a10e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768680230, "uuid": "41ac78f3-db5f-4fd3-b937-49e8b0d64614", "value": "T16BA3825E7A218F7DF6B8C73497FB1B34A77922CA2A91C580D1ACD5012E2434D981FF68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768680230, "uuid": "adfa33ab-1699-4166-a14e-d0e4d9c3c8b9", "value": "1536:fmdurU07J8MtqHxqGPkncW/RVi/wJz8H6xVRFOr4kpKmHId:fma7JLqHxcncWZViTH6xVRFORKmHg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768680230, "uuid": "2a22d10d-8c11-4383-9baf-a71c753269c5", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768680230, "uuid": "aa9be59b-6957-4f8f-9eef-bb93ebff3dd6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768680230, "uuid": "344a181a-d6d2-4082-aec8-df42604de6ba", "value": "tftp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d36c2d2-f347-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1768614774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768614774, "uuid": "69351433-c9d2-4d88-bade-080982475eca", "comment": "Malware payload (QuasarRAT)", "value": "1750450e04d6b23eb5edbc4cdfac3b63", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768614774, "uuid": "863ced45-15f8-4a43-aa29-3bb3624be027", "comment": "Malware payload (QuasarRAT)", "value": "335650f270bcbc765de5add883ca3e060ac3f7c02ddabff895fdaaba211becf7", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768614774, "uuid": "bdd96bdb-6781-4626-ba54-9481554ac257", "comment": "Malware payload (QuasarRAT)", "value": "e60395548ea71a36dc7054e5f5ba28b497e33b62", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768614774, "uuid": "a209c754-50fa-4fc8-8263-8106b55fef82", "comment": "Malware payload (QuasarRAT)", "value": "c84a2e8b5a2e94a534e29adfdc676c86e771be2bc0d4b6ce9eac31230b4a14b8373b3b41894fc15b0f567ab250ee775e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768614774, "uuid": "2df2b1c9-a4ae-4724-8170-fd8d41f83afd", "value": "T1EDE5BF5733D800D8E16AA23489B7CA3AE6727C55037286EF16E84D4F3F33AD55939721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768614774, "uuid": "fc95bfd5-d0c9-4e82-b031-a24dd94655ca", "value": "bdafb39cfee2e23fe0c8ae87ef4f1ea1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768614774, "uuid": "1db80782-404d-401b-bb70-2b97e143f33e", "value": "49152:tNvhM6qHJfTJb5lmzSzko22LGywmtGSlp6NjCw6IVZGKJCxgUiriJxkjqIknagki:KlmzSzko2TjCfoNJCxgJi7DIeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768614774, "uuid": "c8b5c0b4-6461-4551-9d3a-e550e6cbf740", "value": 3195320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768614774, "uuid": "70740f8e-30a6-4878-87f2-2137925d3a72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768614774, "uuid": "d4523e15-620e-43a4-b48f-7017d33c1cc0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8476dd9f-f3ab-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768657843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657843, "uuid": "a4ca5e2a-034b-48c6-a8ae-ab9c51dce5d4", "comment": "Malware payload", "value": "6a336cf915a747f52093e9fb6d99c943", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657843, "uuid": "8c09a41d-1471-4534-bca1-a1f990c7c9c1", "comment": "Malware payload", "value": "342edb96f2b39deccc9d0a6e8c644f9f6865cf9b3536473918276019e2382e0d", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657843, "uuid": "cdcb1162-6663-427f-9f13-57ed779905ee", "comment": "Malware payload", "value": "41a464eac1fa599beaed83b140976b1a967ae511", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657843, "uuid": "0e89d82e-3957-4841-a0b1-ef3535d515bc", "comment": "Malware payload", "value": "6328b685d81c991e6c50d7e85caa68aff7cf5d85aa90b8e8a234c7b184ba9459545ee20009aaf9f7c9340cc4e72e15d4", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657843, "uuid": "e2f637f3-85b1-48c4-94d9-f66b8e2ac167", "value": "T1971182828EA34011E34F2179941CCD91251659865743B62FD1CAF81FA98D290515A9C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657843, "uuid": "eccb5755-c517-4f4b-b522-9c99dddf7023", "value": "24:9TqNupvqaIEVd7YAu+CMRdQiBn7tYKMbOFdcWmXDTMXG+Gb3l:9eNupvZVdUiCQdQiBuKMSgWU4W+al", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768657843, "uuid": "de9a52c3-42c2-42d3-b28f-4599a1dc62a2", "value": 1054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768657843, "uuid": "bd58c632-a693-4189-a39b-24e302583e79", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657843, "uuid": "db596db7-b60f-4b09-a9ea-1f673972aa57", "value": "screenshot20260107.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d58f9813-f34d-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1768617606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768617606, "uuid": "58858a25-c2aa-429c-aae8-87570d45ca6d", "comment": "Malware payload (AsyncRAT)", "value": "fcbe0fb49e48cafd2ee447fb0b28ba43", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768617606, "uuid": "54a902f3-dc12-4b2d-b0b9-0cdeaf61f047", "comment": "Malware payload (AsyncRAT)", "value": "356e07ad6b388968e4594effd117f9099dd178797e553bed90160b323ff60f6e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768617606, "uuid": "cdab5bb4-5c97-4a89-b7a8-c4cbf12f10ff", "comment": "Malware payload (AsyncRAT)", "value": "7384ae27cf0ebb4a455691eb6e78a0e888b3d3cb", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768617606, "uuid": "ed83ce62-52a4-459d-8d89-a3dce8fcc34f", "comment": "Malware payload (AsyncRAT)", "value": "686970bee6df52ab04687eadd08d2e5ebdcfb83dfbd653c97b722a8d3cc1d5fa7e7f225c7d3091cf9b790b1417598b53", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768617606, "uuid": "8e42eb87-a464-47c7-9201-7f9a1c61e5eb", "value": "T197232A143BE9422BE2FE9F7D69F11545867AF5533602D24F1CC002DE4A23BC6EA42BE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768617606, "uuid": "23cfb909-0e57-4388-9fed-77e68e79f19d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768617606, "uuid": "63408fc3-0304-4e21-8523-094ff9b8e5f9", "value": "768:KseYCfoVgcveEc2fH+jzuGnuvTYzqiH9eb1+gUptwbrAK8RccfrWBNDJM:5gcm2fejzNnbzqiHUbvU3ervYc42DJM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768617606, "uuid": "2222df27-5698-48da-9975-aef0f904f7b9", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768617606, "uuid": "a88c8dd5-fdd1-4e41-ae1f-59528395d833", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768617606, "uuid": "dfc45565-5381-46e1-a8ea-9e53ec9b4284", "value": "gStub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c2e5f15-f3ad-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768658527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768658527, "uuid": "cd4b27c5-be9c-4a05-8e9f-c3d828a421ec", "comment": "Malware payload", "value": "5f2fa4eb1fc16f58e6692c527b56f5ba", "object_relation": "md5", "Tag": [ { "name": "193-33-195-32", "colour": "#796955", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768658527, "uuid": "1de8bd89-8d4e-44d2-925c-f5dd804ecef7", "comment": "Malware payload", "value": "3700a70392b76891345dc45b15c601aaa2ddd751a9e16bdf4280e328c5509d8b", "object_relation": "sha256", "Tag": [ { "name": "193-33-195-32", "colour": "#796955", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768658527, "uuid": "4cdc8147-9980-4afe-9e65-350179360336", "comment": "Malware payload", "value": "c0ec14111ddd90a58078e02ac64be36cd07cacd6", "object_relation": "sha1", "Tag": [ { "name": "193-33-195-32", "colour": "#796955", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768658527, "uuid": "5671a97d-a1f2-4427-b796-0a7013103e77", "comment": "Malware payload", "value": "dbecb22968535e6ca5b81d0976159b2b9c1363f079aedeb5368cfc69feb991f9be9474bbea5110ae1b9378f3e8cabab1", "object_relation": "sha3-384", "Tag": [ { "name": "193-33-195-32", "colour": "#796955", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768658527, "uuid": "dc078084-7457-4b04-845a-4bcc4862c4b8", "value": "T1259633679AF71B55D397B531CAA3B00D7B66C288D0C60CB26B1886D132C3D773BA7621", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768658527, "uuid": "818f5524-5cc9-4083-9dd0-8109b27ba899", "value": "196608:Eec5mam4xwExZJ8Ll5RjXdKfaLvQ0DKkHYcu5DWFwsaESrFXzW:lc544xwEvJIl5RjXddL0WwEJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768658527, "uuid": "5ecba6e4-5351-449a-b3d3-8cba7325a406", "value": 8809670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768658527, "uuid": "5e8c4792-6c09-4994-a790-ba42d84981dd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768658527, "uuid": "ab4eecbd-1c04-4c3b-bf16-d74cb041b472", "value": "almcjzdny.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ff5e13f-f341-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768612255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612255, "uuid": "a1bb50a8-369b-42ac-94f2-5aff44e67a4a", "comment": "Malware payload (Mirai)", "value": "417a795c1b041ce7d0baed886739a0c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612255, "uuid": "67a7cb9b-d8c5-4ab7-ac7d-edc5a7d17ab1", "comment": "Malware payload (Mirai)", "value": "38287df704a41e93a4ce2a561b5cb8e0eb4c9cb22d0ab508a08640aedf6c95cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612255, "uuid": "efc4fdc7-4435-4977-a8db-1d8d0919c3ae", "comment": "Malware payload (Mirai)", "value": "270aef5c6f9999b6683916150fcfae59dfb4a857", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612255, "uuid": "e8184743-78af-4605-83e3-3d28dd80ab7b", "comment": "Malware payload (Mirai)", "value": "6f304853616f151d230c0889b0724bd170701feed2a6c98a022afe79f20405a081c49a615cb60a29f049a30d2b5497c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768612255, "uuid": "cb0a8035-8883-47c1-a3b3-0d1bb2a974f2", "value": "T10D334B42322C0F17C0A35974252F5BE487FFFAD122E4F685251F8B668A78E371489E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768612255, "uuid": "b0a94882-7ead-45b7-b6fb-b45c695bcf54", "value": "768:3SjbGSLlRrYj0a8C/dQOhPC/+I20Ja6ZZ+GwPS4yns96BktDgIPi8Twt:ivW3jdQGqt7Y+Z+zN9cGgI6bt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768612255, "uuid": "2216b2c2-4e29-4920-a63b-d9248970e552", "value": 54364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768612255, "uuid": "6b52c7e4-f29c-44c6-8aaa-94a7633f1170", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768612255, "uuid": "1a39ac3b-f3a9-45eb-9221-8f15b621295f", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f88906c9-f3ca-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768671352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671352, "uuid": "60a2c2f2-73cd-4900-9893-c5ff4347cd89", "comment": "Malware payload (Mirai)", "value": "eb3be988c694782ab34e2ba9a0253ae7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671352, "uuid": "118ec283-ed33-4f71-a499-af16b27d33b4", "comment": "Malware payload (Mirai)", "value": "386213ef935ec811949dbf5ebac898eb81a183e62df9d614d74ae008affd5938", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671352, "uuid": "51c6dca0-dd4b-487e-b29e-7a4ccc645854", "comment": "Malware payload (Mirai)", "value": "84cf258f9cee7c27beafe0121438067dd669f868", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671352, "uuid": "81b31c64-e12b-4352-98fa-2ba79a6bb200", "comment": "Malware payload (Mirai)", "value": "ece266c5f3f1f49e614096c7da1884eb8862eda4e7cf01dd581029bbb51f67c7acd9eb9a44b6a9a0d3bbc53079664ab5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671352, "uuid": "0be3594a-6154-4e55-8557-ae8a8b96126a", "value": "T1FC33F21CBD62356DC8DF64B431DF23D9426436A1B26BEBC9C3448CA6612375AF89D06C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671352, "uuid": "0cd53d19-0690-48f6-96d7-1781d7b51a7a", "value": "768:jvPBtD8vX1B+9A4oezu3y8OT4dSfCIt0qsT61f1SYaLk4D1uQHikV19lu02uPyWf:DPy1B+9AQzNrCIpX1fJIDgci3qX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768671352, "uuid": "05d4fa29-8479-465e-9784-bf2e647b0790", "value": 50388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768671352, "uuid": "a7b09212-81ca-42da-a774-0f3254ec56a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671352, "uuid": "179c1f2c-6d72-4a15-aa04-5c3c3ca47957", "value": "windy.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7729ce9d-f3ca-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768671135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671135, "uuid": "421833fe-bf9c-41a0-b794-1443d1219250", "comment": "Malware payload (Mirai)", "value": "c2b589cfaa2e136fd32b8154c025825c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671135, "uuid": "822ce0ac-9c90-4d20-b182-905e5fcbc1db", "comment": "Malware payload (Mirai)", "value": "38711866c0dab5607e187c3a2e015affbbe7d862fc6952bc1e0b16fbea9358e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671135, "uuid": "d74b08f4-99dd-4502-8e95-5bc718fb406b", "comment": "Malware payload (Mirai)", "value": "3ab0dcfc928eab790a53f883c3f98da45da717fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671135, "uuid": "0d07e9d8-e101-4d76-8eb5-dc3ee9cf6a0c", "comment": "Malware payload (Mirai)", "value": "55d40418bce96380c5a11d882764b5d7473b520affc3061a8c016e644416c7b2afca152ba7e141043f7552c04b6a3200", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671135, "uuid": "2a5b3487-f459-45ae-a69d-f2c3afe12c61", "value": "T19DB3E709EF611EF7E8AFCD370AF9270124CD592A22A97F757530D818B24A28F15E3974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671135, "uuid": "a4743104-ac8d-4613-add1-9346264f6c5b", "value": "3072:Idub7djS5HECmVZLWzRRhFcDcmFhhcqpxz:Ido7djS5ECFz4DcmFh7z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768671135, "uuid": "7faaca96-95de-4168-a92a-87d2c03d351a", "value": 117968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768671135, "uuid": "767fbb6d-dbe0-432a-9b63-92255018bccb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671135, "uuid": "1e09ba71-bb8a-4ab3-8690-8af7be146244", "value": "windy.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1987ba8-f3ca-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768671233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671233, "uuid": "178c66a4-7538-4269-946d-0f11a999829c", "comment": "Malware payload (Mirai)", "value": "56908321888c92d47cccfeb7a74122f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671233, "uuid": "a66987ea-dcb4-42fb-a57c-4f03c970eee0", "comment": "Malware payload (Mirai)", "value": "38bba861d872028d9965ba5fc328174dd9bb44373a725a2c9174fca41051fd4c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671233, "uuid": "12766ac0-8730-44b0-a550-48e86cea1c1a", "comment": "Malware payload (Mirai)", "value": "fed776dc4f4c261e8569dfa0a11a88f2f94f2960", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671233, "uuid": "41eab516-5931-484f-9b95-f098f3b8f997", "comment": "Malware payload (Mirai)", "value": "441098c986035873ac9c89379527a7d9000701f2e93a8e633b51183e75ed13dd0a93f901e036e36ceb46939d6f8562fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671233, "uuid": "a1d95feb-18c4-48fb-893a-5bd983b222c2", "value": "T1CC737DC9E983C4F6EC130A350176BB379AB3E53E2169DB83C369A526DC125C2DA1735C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671233, "uuid": "39bd7ed4-8fda-4a67-8b52-b76a1731243e", "value": "1536:mbsv6XewvU+o4x/hVtW9Z3J8h3qaccSXh:mbsiJU+o0/hy9zs3mh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768671233, "uuid": "13b8a5ed-2c70-44ab-87e7-5cfeb802b8ce", "value": 79444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768671233, "uuid": "c66a6ddc-99d2-45c1-9bcb-1ab3d7abcc85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671233, "uuid": "88295586-17c1-4e42-a1e6-35dbb59402a5", "value": "windy.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3fb6efa-f3e3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768682028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768682028, "uuid": "78b9dc35-05c8-45df-a1ef-240fbc5305ce", "comment": "Malware payload (Mirai)", "value": "bcd241712433db99606d1d5f38566378", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768682028, "uuid": "c784630a-b492-46ad-a3a5-7ef25b77a244", "comment": "Malware payload (Mirai)", "value": "38f95be16a0f118b6f95d51cecd3197710e7750cdf16d7628bee74a78d81ac55", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768682028, "uuid": "90b2074d-de31-403d-9bfe-c859ceb62a08", "comment": "Malware payload (Mirai)", "value": "661d3b9d12f1c66dac8b1f8f17044c3b817b5390", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768682028, "uuid": "05c8be7e-0d47-4a5f-9e53-347ed50c18cb", "comment": "Malware payload (Mirai)", "value": "c937ecd027baa34dc060b017d6e2d48092a1a9877aae7094c2ac7c717059e507a7c806f1fe4759e1bd2bbd76d8c28062", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768682028, "uuid": "fdb0582f-beb7-4816-9af7-ccc8c827554e", "value": "T1C9E3288DFA8BC5F6D80748709026F2FFC732B4294076C35ADF99EF35CA239819616258", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768682028, "uuid": "a166d5c1-7585-4710-9516-906918ee88d9", "value": "3072:Z3GJjMCwTbPawGB0nRfPfmUIUnBCztxxLEB04lQNRl:Z3qGDawGanRfmUIzk/SRl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768682028, "uuid": "f61e0cff-0f1b-48bd-a62f-cfb2452a72c7", "value": 144652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768682028, "uuid": "655e163c-71d5-46e7-b7d8-12f85f71c521", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768682028, "uuid": "4de5272c-6873-4b6e-98fc-fbf255dd7d1f", "value": "Polar.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6152c3ff-f3cb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768671528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671528, "uuid": "23499142-3c47-42a1-8dc3-7074fdac362e", "comment": "Malware payload (Mirai)", "value": "164f90fd4ec6a072540a1ed738dc4c9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671528, "uuid": "cc20e09c-e531-472f-959c-977c271424c3", "comment": "Malware payload (Mirai)", "value": "3a41bb669485fcf39ac90788f8e99962ea9ec3120f4d706ee57f20a789026844", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671528, "uuid": "cb4944f7-c833-4afb-8417-89324f1a7b8a", "comment": "Malware payload (Mirai)", "value": "7542b7d9c2d056a28747286d8a13dbc2ff61f252", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671528, "uuid": "11050bfa-2652-4fe6-a10a-74870c442f0f", "comment": "Malware payload (Mirai)", "value": "4dc0dbb346b695668b3081ce80b1c5348b3e7c59d472cf10d42f496c5537b04942a88bbe3266bd3244eaf43c026e49be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671528, "uuid": "7c8ffdd8-f9b2-4b0e-9677-c670d3262e05", "value": "T1B19329C1FA8BC2F5C41784305162B63FDA32F96580E1DB9CEF5A9F35CA33581A612399", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671528, "uuid": "c11c9c6b-c3f4-49fd-bcb7-026ff2b78c06", "value": "1536:Gr9duKUOJBN/jTiC1I9WuUArtD5p7vS0EWN67n9Rg6S8LMwnuM5iPQw:Gr4G//j235lrbp7lZkb9RgX8vunI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768671528, "uuid": "34315d0f-9c21-4f85-899a-e2147779d5b1", "value": 95792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768671528, "uuid": "95485322-628e-4a04-9a9f-6d8fef18f1c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671528, "uuid": "d0d32e8d-bc1a-4a43-b9e6-4be2fbb39fb8", "value": "windy.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bacfef6-f3e3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768681719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768681719, "uuid": "2b5f794a-69ce-4733-9b88-106bb331e9e5", "comment": "Malware payload (Mirai)", "value": "c5304367be04944d9b365791aca123a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768681719, "uuid": "c34d39ee-7aba-4d51-a9d7-2a49d55b0f01", "comment": "Malware payload (Mirai)", "value": "3acaf19321e66f5b5d65701ba4ee2a8ba8e7b922d37caa4248979a060f646c29", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768681719, "uuid": "ee0d381b-4c21-40c0-9afd-442247e0b8ab", "comment": "Malware payload (Mirai)", "value": "9f858e7ba47463207f37584cedd6de216093c9c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768681719, "uuid": "52e1238d-745c-4763-b268-4381ff02b645", "comment": "Malware payload (Mirai)", "value": "7df0d61b6b3f02d04e5ea5379b9bf1f6bb050503215c18935f4722bcdc1c2ed70dd4f55c99fb532dd60e098ad8cd7472", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768681719, "uuid": "c731361e-80b9-4a3a-a1bd-2d9d302d3a2a", "value": "T145C3AE97F78B24A1C86246F007C76B8E3E6362019E6BE9E76C1E753B19390DF19063D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768681719, "uuid": "0b655d64-d641-4c69-abea-420baf010dca", "value": "1536:H6189r2mIHgqH8INWZzEB4Z+LaLWqhIij5AKBMeFCjxZJOug9e/LWA:a1ur2nj7wzEqZ+Leth5AdeFCcug9eq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768681719, "uuid": "6d8f5a15-1972-4200-8c01-5034e74c5d10", "value": 124352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768681719, "uuid": "942a8f86-cf7b-46c7-a5de-f8fe462f1ea0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768681719, "uuid": "b1b0694c-5fda-4b8a-8375-479f2af2a1cd", "value": "windy.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd9c22a4-f3db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768678608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768678608, "uuid": "390d657e-8965-408c-9edf-44cc1e328c6d", "comment": "Malware payload (Mirai)", "value": "561403a0e9a8f44440701c4e827a23c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768678608, "uuid": "0785214c-a418-46be-9964-d7a51bd28395", "comment": "Malware payload (Mirai)", "value": "3d38bbdeebc323e204f4beaa00aa7869955cb8377d6f33521c3c293617308ef8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768678608, "uuid": "58f9c128-747a-42f9-a15f-663e40997563", "comment": "Malware payload (Mirai)", "value": "e6f75aa5a55f9717e6018dd526d6a7021a7fa1e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768678608, "uuid": "9891eb96-1911-41ca-9b7b-bd7cc578a744", "comment": "Malware payload (Mirai)", "value": "2d20ee874e91e3d81cc2192ab95b752de82b62ef52039efa986c35579c7c21d699d277087cb7cbaba0bbc3fe1e507a78", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768678608, "uuid": "e76c5841-58aa-4a76-96b9-45042bf3970e", "value": "T116343946EB804E13C0D627B9FA9F42453333D764D7E77306A9296BB03B837AA4F62505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768678608, "uuid": "97f9c7ba-a34d-4bb3-b97c-263e6adbc7d2", "value": "6144:BFbdxMAzvrqwWWeqRuagXvcp8tobpnu2l3++e8V/Gbcfl:nbdpqGJRuaQvcp8twR1l/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768678608, "uuid": "c0a2b0ce-426f-4bdf-a2ad-8f7ddd5d4f8f", "value": 251908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768678608, "uuid": "846c9626-7cc1-4cc8-a3da-bdbf46833149", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768678608, "uuid": "a132568c-34ac-4c62-bf70-19a16f6e6799", "value": "Polar.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "497549ed-f3c9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768670629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768670629, "uuid": "2a8c2eaa-d5e9-410f-a334-1b2a217aa6aa", "comment": "Malware payload (Mirai)", "value": "138df4fdddb8899c9997a229deb3def3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768670629, "uuid": "6a60843b-3f6d-4ee4-9240-47a960ccc03b", "comment": "Malware payload (Mirai)", "value": "3f80da2aa6c75ef9766e182689ddd7747c792a70f9650dbab1b32906a6fa01fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768670629, "uuid": "725b5056-18a2-4e96-8189-3456942ff4dd", "comment": "Malware payload (Mirai)", "value": "95c6453d1e9e20156dc59f787d8a044c91cf1336", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768670629, "uuid": "2ee3d77a-f2e0-491b-acaf-acc60fa37b25", "comment": "Malware payload (Mirai)", "value": "1cb46d90f95a46fbc2e209574027dbd40894ddadc992cd05c80419e721e512eb7f5f21950226cdd5ff436e2698afddf3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768670629, "uuid": "3944e486-a79f-40ab-b490-71e6f5684020", "value": "T172634C4272280E47E5A21DB4253F1BE043FFED5024F4BA88694FDB5A8A35E761186FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768670629, "uuid": "acad3d2b-948f-4c05-a261-49fdc649d69f", "value": "768:3tzXhsT4axOTlLRnE/qPxTS16xeqqPvHr85vJl9TwJbAWIKZhHFRZfB2BMxCq2G5:BigL6kTS16xZWD8bqQKZo3qsZIZy8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768670629, "uuid": "91df38da-2a62-4e9d-9a09-707b9444a216", "value": 66792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768670629, "uuid": "6ff3fc24-bf55-4b7c-b176-2fbbd0734c58", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768670629, "uuid": "fb2a30ea-fc5b-4c5d-9d3b-dc141907a04a", "value": "vcimanagement.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bc09157-f3c9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768670633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768670633, "uuid": "511b797a-df79-4cfe-b16c-3b1857813507", "comment": "Malware payload (Mirai)", "value": "729ad3d0003ab699d3ed058f2cc3af9e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768670633, "uuid": "893d2f65-dd6b-4045-b460-1b40fdb1ce99", "comment": "Malware payload (Mirai)", "value": "4020e7855204331bdfe73f50463cab24c993dafd3212d95e84abd4186dc6d642", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768670633, "uuid": "c3a65a02-1156-4157-b152-637bccb2c78d", "comment": "Malware payload (Mirai)", "value": "e3efb59d3f3a7014c8e9f9d620adef84054da082", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768670633, "uuid": "5ad4b1db-2603-454f-9c39-4913c3d4d0f6", "comment": "Malware payload (Mirai)", "value": "5d3f1af73bcd0461de2f27a95585acc8e14c1e6edd92499937d82759124f1bd7a9e24f373d6096e53d270c1c0b5b0bb1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768670633, "uuid": "faadd166-d65b-4641-943e-b7af415c6b36", "value": "T1D383F895B8C18E11C5D423BBF92E018D331267A9E2DFB2139D206F147BCA92F0E7B955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768670633, "uuid": "eae00d50-e880-4d00-8c68-1727c168fae9", "value": "1536:0uniLgUALK//zA8dAr5UINTK3WHf1SJ2BpcQ7qWgi6N1DxKZw5e5z995FZRc2I3A:agBLw/08c5xNu3UfoJIpcoqTpNxMO0FF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768670633, "uuid": "029a9e8a-9b20-445a-a1b8-a21d9fe230d0", "value": 80988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768670633, "uuid": "39415aa8-0ee5-4f2a-ad50-ef7954a4e813", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768670633, "uuid": "241dfe8b-34ee-400f-89f2-e6979ff44a01", "value": "vcimanagement.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb59c802-f3cc-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1768672135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768672135, "uuid": "9b805f82-13be-4d8c-8433-9d659e3cfbe3", "comment": "Malware payload (AsyncRAT)", "value": "d8aa894ba8f81032496ac509b9ffa1b6", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768672135, "uuid": "1274ae4d-4d2b-4abd-98b7-a21dda2c7b6b", "comment": "Malware payload (AsyncRAT)", "value": "4040bcbeb29b512c0bb6a96884d5afa1e333a7ea1ab3084db1d9af932719a05c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768672135, "uuid": "677a4e92-b51c-4818-88a1-534f9742404b", "comment": "Malware payload (AsyncRAT)", "value": "097072dfa5470840fa7f202efffff1d28eef8218", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768672135, "uuid": "9e0e30dc-de88-4876-a42d-d51cc0cc7581", "comment": "Malware payload (AsyncRAT)", "value": "3e40874548d4cee0eb3a9062d2378acba6c2cfb3b488d0ccba71af089de953ce6cb083643b566a0869909dbe4e5c9b7e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768672135, "uuid": "fe743320-81dd-486c-81de-6131bb1ec9a1", "value": "T1D4434B007BED812BF2BE4F78A9F26145467EF5633603D64E1CC4429B5613FC68A426FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768672135, "uuid": "5fae92f8-706a-4a70-8133-c8282df98c22", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768672135, "uuid": "5972c1b4-29b2-47ef-aa03-5bd606d2daa7", "value": "1536:kuYs1T87z2Jen/f3q3bvXSApORdvhJa7n9XC6F:kuYoT87z2En33q3bvtEhhcRXC6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768672135, "uuid": "f5c14781-7477-4fae-97eb-c2d7e76c7887", "value": 57856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768672135, "uuid": "99f502f0-4c1b-4e1e-bcce-15b654fd9516", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768672135, "uuid": "10147c63-5b26-4a5d-9d25-436e0b14131f", "value": "Google Drive.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f805d042-f3d0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768673928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768673928, "uuid": "6e971fdb-9d69-4216-921e-109e1369b3ff", "comment": "Malware payload (Mirai)", "value": "78688a3446d99dd7934ab54ae0eee856", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768673928, "uuid": "9ac7fea2-39eb-4934-86b8-8adf15afea6f", "comment": "Malware payload (Mirai)", "value": "428719afc8eef38c6aec15004861949fedeabb5af0247f56df77f1ad02bde83d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768673928, "uuid": "108ce845-b2a3-4f8c-8e56-70493ce86d47", "comment": "Malware payload (Mirai)", "value": "1dd6dc86e67e8db92d403adf75ae3c296e6d67c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768673928, "uuid": "cc82220f-bb5c-4091-bc94-5803a874dfb0", "comment": "Malware payload (Mirai)", "value": "ace587c3dea7bb7c4bb50b8d32243ccb7cd68d6962873109fc68bd476d84cca1b9a401938658b66acaa88d126c1da092", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768673928, "uuid": "a1845c59-2a5a-443e-8893-1bdaed18fa97", "value": "T190833AD7F400DD7DF80EE7BB44534A06B271B3A117931B3A6397B957AD321A44862EC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768673928, "uuid": "e4c0de23-9e05-484f-b16b-557b067401c5", "value": "1536:dsXjnRknf+xR6sehA+RgFgM8VyJPFOBRcsa/77zI6NzwnW4bLzkXkukV:dsXjR2sEbnRgFgfyJPFgw//zIKELzkUj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768673928, "uuid": "b11dd7cd-6f0f-4edb-b48c-ece4842daa0f", "value": 84476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768673928, "uuid": "e11c60fb-cd8a-4d02-8b69-dce76d94b946", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768673928, "uuid": "54ffbb74-16fd-41ed-97a4-703ca6a77a01", "value": "pm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d621c507-f3db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768678596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768678596, "uuid": "11cd2c04-66b1-45de-a3e0-8a99e2d71839", "comment": "Malware payload (Mirai)", "value": "3af0e152fa0590eb0a4c8354a2a34b6a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768678596, "uuid": "8f0bcc23-5fd6-4917-86e6-d93579aa9231", "comment": "Malware payload (Mirai)", "value": "4429f00e0efabe0ce89644caba8979e00a2b064bde1e43a30b87e3c4a345988b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768678596, "uuid": "30ba457e-98fd-4fb3-8d8e-13117c11e3af", "comment": "Malware payload (Mirai)", "value": "a48a879a9ef1a2ade873656abc2688ef43c6cdd2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768678596, "uuid": "51ee869a-43cf-4e3c-80f8-ce7169d84268", "comment": "Malware payload (Mirai)", "value": "6ab2e287bf1edbc73a7364d022ee12bcd807d2b8da3a9c98f1a2ee1b852fd2bf5e11ff701562993e0ce7085bff7839a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768678596, "uuid": "1f8ce8ab-9707-4874-b365-07f11c76d3ee", "value": "T14C9312E1997B7AE2ED8015B0ED7544EEBE488A3D85537E0722AA044C7812B7F0C68F13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768678596, "uuid": "ffa5aeaf-0145-427f-86ca-92657839e5d5", "value": "1536:FAT2VHdtpRhs3FM2pz8S+gtakx9yg55iyZ9i6IPvlZLzo1stkLICbSnU+Ass5w5o:W6Rp0DpNxjnZ2bLzQKCbS0u56zT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768678596, "uuid": "c27210ae-7039-491b-9604-6f02535910f0", "value": 90576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768678596, "uuid": "2d1823b5-c316-4da2-81fb-9dea66023c2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768678596, "uuid": "6d5db3ee-c311-420c-bf17-de7c71589dac", "value": "Polar.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8eea4ea-f3dc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768678950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768678950, "uuid": "b83e3277-44bf-4c1b-ba60-9d35c8b1c4e1", "comment": "Malware payload (Mirai)", "value": "9fc5c8961987da108b6386f0cbfb52ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768678950, "uuid": "f7996367-e1b1-4143-9fe6-fbf52da00da4", "comment": "Malware payload (Mirai)", "value": "4476a4f8616cfe832f9740c6aadc02d72976b81f123ca2ff8ceb8b5110bba58d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768678950, "uuid": "7069c5d2-1e14-4ad0-912f-a3529fe50b25", "comment": "Malware payload (Mirai)", "value": "14aa179b8a97c2c90d95081654a4d43995361423", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768678950, "uuid": "6f942ffc-c37b-404c-a4e2-c0511ba48a5b", "comment": "Malware payload (Mirai)", "value": "a70f0324cbc1fe0796ae9204f215f07061d31baa05c463db1d8687cd96a1231a06f224f87e9d656a74cc4ab506a2dd47", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768678950, "uuid": "0c27a950-a829-4254-bf83-b20f37b28ec7", "value": "T19BE2E21576CE94F0C5341835CEFE854A73C745F9C6FE252A90E01364BEDAA0B58BED88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768678950, "uuid": "63ad869e-6e48-4df9-944a-aab98a1777fe", "value": "768:c1be+IGP+RuX7+7SdDkSb5k07f1Ks3UozGZ:c1S+J+RuL+74Dtb5XFzk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768678950, "uuid": "d36608ae-ab29-483f-924d-5520014aa5fa", "value": 31724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768678950, "uuid": "b961006e-4bcc-4cdf-89f2-5451010b1c4a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768678950, "uuid": "88661f5c-7496-45a4-af5b-ef97268e7b41", "value": "Polar.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "725ff356-f3aa-11f0-a129-42010a9c0007", "comment": "Malware payload (LummaStealer)", "timestamp": 1768657383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657383, "uuid": "7893bc5e-c003-4064-94f4-9e180787f1ee", "comment": "Malware payload (LummaStealer)", "value": "f441161ba119e2c70c34368be5ab26bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657383, "uuid": "da3e34d6-c365-4fc4-9b54-f7c75fc8c009", "comment": "Malware payload (LummaStealer)", "value": "44a91e9399ce387891d4e51af41e26631326766642a2c0c506877df922add2d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657383, "uuid": "bd4579b7-8b90-4d05-ac9d-6e641be37174", "comment": "Malware payload (LummaStealer)", "value": "c9ede2715d62e77120ceb63e3b08bee700789781", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657383, "uuid": "9888e446-0f94-4be2-9556-6ba735ef4a47", "comment": "Malware payload (LummaStealer)", "value": "39ca2c5329d64b67344c21703032b1cf33516283e28be74939b9dc66cad4ed0bbed577b04637651679fbc9c8f59cb594", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657383, "uuid": "031747df-b446-4be0-9bd1-e7f7e7e1bf07", "value": "T11B775CE2FE500776D69BA33ADDA2524A1230F145133114D7BAA817958D6BEC8133FB2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657383, "uuid": "eeaf90ba-f9d0-4c42-abc7-e2f6d739584f", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657383, "uuid": "652539d9-078f-4868-b769-8ebf492734c4", "value": "49152:NzgXIkFT24BdS433aLL0P++GvWGLDMwMg/qAsLqT4XICCOht7vpTzcMM6l/CZCsj:N+vBz3qLIW+G3kbn2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768657383, "uuid": "cb40cae3-e273-4789-ad14-a2fbf773b9a6", "value": 33815688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768657383, "uuid": "a82ef4f9-835f-4bab-b961-50d6dfba6b2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657383, "uuid": "e6a14e10-dba9-40ac-bcdb-1245e20f2beb", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a181be3-f3a9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768656832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768656832, "uuid": "c2d3e660-1549-4899-b0ed-b9b3a82cb690", "comment": "Malware payload (Mirai)", "value": "6a3d1f09c39c8eb709c84d7a05061b26", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768656832, "uuid": "3cc99e32-6aec-44dc-a3f6-5bb68d68f93d", "comment": "Malware payload (Mirai)", "value": "462155bd112b8f938fdb917e2ebed13468b5ed3b1eb945222f12a7c85654390c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768656832, "uuid": "3468ac59-27d1-4328-8c8b-d92b00267287", "comment": "Malware payload (Mirai)", "value": "0b659a5fdd50dd78d90418817411713a46ddefd6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768656832, "uuid": "95318082-4169-499a-b92a-1182d6bd4848", "comment": "Malware payload (Mirai)", "value": "19de90d6e282aa9c143d4cd16b266e13c0c983e870af6488a5184b5c4a0e7ce0ef9f1e058287067907205e34691f721a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768656832, "uuid": "95cccad1-56f8-4657-8175-4d0e7ff7e983", "value": "T1B3935BC9E7C3C8BAF91200752036AF32DE73D67E612ADE47C3AC99319971550CA2676C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768656832, "uuid": "b7ff8559-7beb-4f3b-b021-c6242b19429e", "value": "1536:EnDzcFFRje2QPFGnSqU5Iz+Q+Pf8EKnsG8veB6rS3gYCKmmh:WzcFFR6TPFeU5JrfonsXv+6m3n3L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768656832, "uuid": "d88eef34-a474-41d0-a158-8c69bd0dbe89", "value": 97096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768656832, "uuid": "451ab5ad-4170-42cb-aad6-af12a3c571af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768656832, "uuid": "72bd9780-8338-4208-98f4-0a5e23131ea7", "value": "ub8ehJSePAfc9FYqZIT6.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b718d463-f3e1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768681121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768681121, "uuid": "5c9d238b-ec47-49f0-87f2-97459b58124a", "comment": "Malware payload (Mirai)", "value": "9aadd608319cd2dac8ccf2b4b6ed3dd0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768681121, "uuid": "95b46b41-1a43-40f0-9c50-a22b09917b31", "comment": "Malware payload (Mirai)", "value": "46d699e5fecb934da82228f81c8d2ede537e4ed84cdcf0c6816dba773073577c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768681121, "uuid": "415228ca-d0d5-4b18-aa98-b0098d39a376", "comment": "Malware payload (Mirai)", "value": "341b1209dbbf53f249f69296ed28142d0033e3f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768681121, "uuid": "f9999a48-a52d-41eb-9b0b-d87b9a4c370e", "comment": "Malware payload (Mirai)", "value": "5073a7921e4c8513350c7e6bbecd9be32d34e8ecfbf6ebb16a1980faeee411a36fa20aa3ef628871d9bbcda861cb7d49", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768681121, "uuid": "f3888e89-bd52-4ed9-b1a4-4acf268318b2", "value": "T160630206B6227896CB9A5C3972D8E35C1EE161D7E2E5DF6D031986DDB23418CA4CF20F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768681121, "uuid": "f21ecf3f-f295-455a-aac3-46cf1472d82d", "value": "1536:076LrBbvyzJeEBjsBZc5j0qCT/IA+ijavyfjiMO9fmVElBbCP:07kuBWu5j0XT/qija624kY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768681121, "uuid": "de9bdf30-6ec0-422c-8ade-8b44da5d6989", "value": 73256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768681121, "uuid": "a0544455-d5a8-482a-9daf-e729b03c3f60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768681121, "uuid": "8254ffa0-3b44-4e81-88fa-3444ff0ec258", "value": "Polar.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46dcc0d1-f3c9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768670625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768670625, "uuid": "a6382352-c3ba-44fc-a949-edeacf713295", "comment": "Malware payload (Mirai)", "value": "19f8497d200d19e39cdd433cbf2a38fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768670625, "uuid": "e6840241-5491-4938-8ced-a1af6d11ca59", "comment": "Malware payload (Mirai)", "value": "491bd8f6e84b6d2ff293a047a3ede3f4955d1de734e022dd7e8833e5a31dc92d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768670625, "uuid": "adab0fa0-06ab-46f2-afcf-8927ac800fcc", "comment": "Malware payload (Mirai)", "value": "65631a64168ed77dd57467d3c9f8414bac42fda5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768670625, "uuid": "12fab0e5-31a7-4b1e-a1bf-7bc0b4e51743", "comment": "Malware payload (Mirai)", "value": "b1d0109bb66c655953336401a01071336a4c81637a53b1cf049a35fbb5827c43820ff6314dd801ce1b912b69d2d1c1ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768670625, "uuid": "eb71e4cc-3a4b-4ef6-9fa8-e98d8c55d299", "value": "T149E47D98FE5E3D43E2C7E27C9A8A47B1312BB1E4D72282E27541531DE4C6AEEC7E1501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768670625, "uuid": "bcb2fe67-e400-4a80-aea1-4d418ecbd0a3", "value": "6144:dev4RTvIHdRQWS4FBrr0+FsB+MvpGWnIuTlojQuhxFT5DsTa2DTe3gi8tmgEoqw3:wRQsrr1qQMvpwslFuNSTasU5w58ROn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768670625, "uuid": "1f042312-a384-4235-8ff3-7afec8ef470a", "value": 665264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768670625, "uuid": "d514a6f9-d393-41ba-85e5-eb4f19616ed1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768670625, "uuid": "dd7f1218-0f5a-4d3d-9810-d86eb39a1bbb", "value": "sora.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70fc0a37-f3da-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768677997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768677997, "uuid": "8def74a6-b5bd-4cdd-bd93-436af5814849", "comment": "Malware payload (Mirai)", "value": "85389c335eb51beb1cbc3c3a2ed74f90", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768677997, "uuid": "83389232-ad18-43fd-b7f8-731f0a5226d6", "comment": "Malware payload (Mirai)", "value": "4a98d6bd63190c2aef2a7567e36f11fafbf12d64c161ec17bc01f60384ed30d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768677997, "uuid": "5f80e20e-739b-4842-8798-385109277728", "comment": "Malware payload (Mirai)", "value": "c900c45c72ad4e7f4900baaf81f4e97e53ece2bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768677997, "uuid": "7aa55c85-4898-4c83-afd4-1c0514c1d17b", "comment": "Malware payload (Mirai)", "value": "6fdd2ac310a185315f73c27b794d1388e457438c0de0aeabd0dd4adf6a0ffc1c2797e825a295f4d185df4fd155cdbb17", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768677997, "uuid": "67b01640-e384-40b4-a0e6-6ea5082a97a6", "value": "T11563013E05463AB1CA64C47B04B50B5B0D7F4FA380528C643DB5EEA0AE16E3838C77B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768677997, "uuid": "0d490e7e-50d5-4306-bf5c-1d3b0132894d", "value": "1536:gWMtWYif+/yF27IafNdeUN02+F6jTwsglGkeXnmoMqsTAATM+CcelRwaQC3oNb3G:gRADCZNdB+MHX1XMqHVRUioldVQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768677997, "uuid": "de73c326-6b15-4a24-a62c-535d1798b7d1", "value": 71188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768677997, "uuid": "a494c85a-65e6-47e3-99b3-a5cbf791fa1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768677997, "uuid": "07540c06-cfb1-4bb6-87b0-c1b192a351af", "value": "Polar.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a05aa973-f341-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768612363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612363, "uuid": "441f57c2-1d67-4dd8-ab23-c4a70811cc03", "comment": "Malware payload (Mirai)", "value": "074f529e12f685610fad76c4c646312e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612363, "uuid": "f7c7e1ee-0198-4f6c-aebb-c14ed961fda2", "comment": "Malware payload (Mirai)", "value": "4b52d1b1539c60adb4fb9ce833b2d007bc4570a0810fb2529ff650e02d791c15", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612363, "uuid": "24c37dbe-a78a-485d-8cd0-f3180a0ab8fb", "comment": "Malware payload (Mirai)", "value": "088b93fcc0f5d26ac54014bb3b048cdd8ef695e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612363, "uuid": "fd8433b4-4371-4356-9758-ae9066b6a83f", "comment": "Malware payload (Mirai)", "value": "ea44fcee7c8c98c0de899392d23b9b63188330d6d544b1ecc2f0b0c11e76e52e5653dbb806f6519a354d73a685b05ffa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768612363, "uuid": "70bd47d1-bd6b-4fed-b671-9e273a20178b", "value": "T15C63951E7E219FBCFAAA863447B78E16564833DA37D1C581D1ACD6012E6064F340FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768612363, "uuid": "9ced35aa-2966-4fdb-b94e-1b2a70595d73", "value": "768:7ZmnnogDILQHYLQHPVVMr4mgYVVMwKykNVVM6r+g/RtrVSYogDOsS5siv5XLatAu:UnN4ZH2SyOyuIq8LMEIUq+cvtpvXz9L8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768612363, "uuid": "73188114-e7cc-4662-85a8-ee87af4da328", "value": 72024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768612363, "uuid": "719d818b-4867-49a7-a39f-27046aad7de7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768612363, "uuid": "383e7bca-20c2-4098-9533-6674ee8672c6", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8b88039-f3d0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768673930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768673930, "uuid": "ac34647c-21f3-4977-a4c6-a95e0676187d", "comment": "Malware payload (Mirai)", "value": "fba4d1b4daee8b3659b06bee3fb46179", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768673930, "uuid": "9e95b2b6-d26d-4e27-af86-82ea6022c819", "comment": "Malware payload (Mirai)", "value": "4c46273d4d2e8b7404b2bb6f4809d2869f946f9d7359a21d700f24125a86c1bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768673930, "uuid": "2306d631-5b90-4782-bca2-7fc17b9b63bc", "comment": "Malware payload (Mirai)", "value": "8402615e5c6851cc18bdfeb35849f35e7d176959", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768673930, "uuid": "82b860d2-45e9-4713-aa61-00a4993f7e7b", "comment": "Malware payload (Mirai)", "value": "d17ee0f9f4b47f5d5fb07630eed909becef5235c779c83819fcbe928ff068baaa989a4a8a1dec4651f47fed906da21f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768673930, "uuid": "5f14aeeb-1312-4648-89ca-720598d5ff91", "value": "T1F0A3D81E6E218FBDF769833147B78A25A75833D627E1C685E15CD6002F6034E681FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768673930, "uuid": "d0e6ad97-9c08-4c8d-a2b7-43ccca8af61b", "value": "1536:54ZJXGOnGNDkTKeqnM4JLzmr/i3xEPeHuCmoG8YL2:GZxGOnGNDdeqVJLCr/0EedGlS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768673930, "uuid": "82b3f184-63c2-4053-8ee3-e0cd7eee9e9e", "value": 97736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768673930, "uuid": "a6ee6cb9-38d0-4ac0-b026-a2bb30d07d99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768673930, "uuid": "50e0b88f-198e-45bf-a840-3837ae4f50ef", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6a4eafc-f3ad-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768658867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768658867, "uuid": "42ed34bb-6ef7-494f-8c39-c2882d74d398", "comment": "Malware payload", "value": "e9ba75ba01122eb4b21f0939a145ac2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768658867, "uuid": "f4e7733d-c74b-4f6f-9841-a89a6262184d", "comment": "Malware payload", "value": "4db3acaf96dd741148ec01364c8948e7b2e9324aa176ef63e2130309690e6359", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768658867, "uuid": "2e339d44-2859-4610-ac1c-e96a0e29c757", "comment": "Malware payload", "value": "bc0e79c61229376bf6d611ac504589e1bcde8f8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768658867, "uuid": "2c4639d3-2919-403c-bcb8-d29305c24099", "comment": "Malware payload", "value": "7262cdb5a0205cdc5351adcf76b3c1172cb2e9103313f10a209ec90d931c4ca5a43667f0d7b1dfc6920e6dfa3fdfda9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768658867, "uuid": "0c568f96-1800-418a-92ca-f10e2ccbc420", "value": "T1C00833C86B414C5EDDA8433A4266DD1C5EA9F0CED3ED080BBBF418661E8F3C99A7D641", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768658867, "uuid": "f9818533-838c-4daa-9e6a-395cfe61e781", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768658867, "uuid": "704fd3ac-d65f-4cf9-babd-40f7829df0c0", "value": "1572864:mTbci+8PkxEWA4Wb0izXUb9jETHPQmMpnx9luHY7otnq/2caiI2qoeTZkhmqZSP7:EbUqkEWP/jcvPOn36uwGeTgps", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768658867, "uuid": "5e830bed-8e68-465d-bd25-f040fc306196", "value": 83676726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768658867, "uuid": "2cec93eb-e4b9-47a6-a02a-9c61a3c900f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768658867, "uuid": "4ce09655-e5f7-4fc0-81af-b792c9b73f68", "value": "taskhostw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f3ed9b9-f3d3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768674880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768674880, "uuid": "ea5a338e-ebd4-44a6-9fab-e0216c99e566", "comment": "Malware payload (Mirai)", "value": "8394fe594841f21382560ced3df0b590", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768674880, "uuid": "1c5396bb-8314-4067-b663-465483264b86", "comment": "Malware payload (Mirai)", "value": "51f8f0550b5383eee78778f392e2df67b3893dbe490bb257436222c36a9d6769", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768674880, "uuid": "18066762-5e9f-4e7b-9bc6-6412dea30ece", "comment": "Malware payload (Mirai)", "value": "d86b0c97a2568d44bd444e1224bee174f88c3a1b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768674880, "uuid": "70024a99-6434-438d-92d6-57c8e9bf7c54", "comment": "Malware payload (Mirai)", "value": "d7e1422bcc2f8cc25aa43b057a7d778dea050b6a0828dee731c8c3da9a596a3ab14d19181fecc1c1869059caf01daa0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768674880, "uuid": "220aecf6-a92f-4a28-9792-ac91f07e3e81", "value": "T16BF3F70AA9419F11D58335FAFB9F415972536FB8E3FA7102DD20AF6023C6A9B0F76502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768674880, "uuid": "b433b1bb-2baa-44c2-9a74-3356c65ec385", "value": "3072:533XlpWGo9FzBoiUr1w647FJb73+yax4Tok4aBQMbqMzsev/YiZHu2WlG:l3XlpWbjBo/1Bqbb7uyax4Uk4aBQMl7l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768674880, "uuid": "9d524f50-f626-4c5a-bf09-82c86a68bdc4", "value": 171244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768674880, "uuid": "66afe2a6-3ebc-4b81-94c1-dbfebab95279", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768674880, "uuid": "ac686b55-54ae-4f16-b5ea-5000076161fe", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4271621b-f3b0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768659880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768659880, "uuid": "433962e8-bc5a-42c8-91f5-af00c65ad9a3", "comment": "Malware payload (Mirai)", "value": "d1082ba4f6a77e1e379b57125639f7a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768659880, "uuid": "d3937025-a956-49c9-ab8f-f9232dec4919", "comment": "Malware payload (Mirai)", "value": "51fe91dbc6d6e391dada652434cdd68acdbec815b1037e3d32da36850e0853ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768659880, "uuid": "372b2c39-3780-4f83-a4ab-968d55a06290", "comment": "Malware payload (Mirai)", "value": "f47cfb6d2697073a9a96826c24e3011221f63b49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768659880, "uuid": "4362e6b3-cf35-4381-ad38-da8c434c71a8", "comment": "Malware payload (Mirai)", "value": "9f5b5f6c3022a0bdd2fdbb52d7b54c4575b5ac1a2b275f0f3006d45964f065589d18c8e0e74294b3fe1b935ecd3c128f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768659880, "uuid": "dd699bad-918b-42b9-8b16-59a5d6916e87", "value": "T12FE31907B99080FDC8E9C1784BFEA136D932B5AE123CB15B1784AE362B5DE301F6D615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768659880, "uuid": "eaf93918-945e-497b-9a13-7217b5c8f49a", "value": "3072:aQXQgYvf3q6hr96GX72XYhw7EcpmzwMuuBaW66NHde:VggONJwtmkXkx9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768659880, "uuid": "2baeb297-cac6-45dc-99e3-a43d2067926e", "value": 143288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768659880, "uuid": "bd5ad977-e04c-4862-b14a-ba1ac0724915", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768659880, "uuid": "998c7b9e-350c-4e74-b2e0-f62ab88eefd6", "value": "ub8ehJSePAfc9FYqZIT6.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ee5772b-f3c9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768670638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768670638, "uuid": "787c0fd6-fca9-4748-adc9-86122aaef3bf", "comment": "Malware payload (Mirai)", "value": "3a81ff8a2df4d0c3ae62e2704fab8a29", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768670638, "uuid": "59a6ecdb-d713-480c-a0e6-e4a314190b6d", "comment": "Malware payload (Mirai)", "value": "5466eff12df5195e6b9b831879ab8cd536dbac37c79fc9dfdd4e6bb4398956a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768670638, "uuid": "1ae371f7-fd62-4008-a7f9-f6d1bd950753", "comment": "Malware payload (Mirai)", "value": "9ecbf106240eaeb5dedd0fae3a50296e59babe3b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768670638, "uuid": "1b092a14-5c3b-4c5f-a718-ac295172c481", "comment": "Malware payload (Mirai)", "value": "d7cd29b68f2b214911759c50cadc5d7daece6c79906234d07c9923dac5390f883d19a30e4e086993f494fe5f96c0f252", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768670638, "uuid": "3164ec52-e183-4e55-8f0a-6911a72f04dc", "value": "T14B93B30ABF740FF7EC6BDD3749A92B09158C550A22E97B357930D818F64B26F19E3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768670638, "uuid": "18b6573a-3802-4727-b6c3-3986c41a7ae4", "value": "1536:zahaNVXM/WLJVBjzQkv32I3LY/0B/BXsZiaBLTe:zahGVEWnB/Xu2HXs/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768670638, "uuid": "74cf297a-1003-4cba-8a9f-3c9c9149085a", "value": 92444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768670638, "uuid": "70079515-f232-4b6d-b287-7c62a8fe9779", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768670638, "uuid": "71a6dac9-f30c-45df-998c-aa59f950d34f", "value": "vcimanagement.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7bab6da-f3fc-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768692691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768692691, "uuid": "77e89bf3-81e8-428e-a4ba-cbc098e3b83a", "comment": "Malware payload", "value": "d8d4272e16b1df61d07bfd6e03400123", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768692691, "uuid": "a4e7ad9d-3729-480f-a58f-cfa9e06274f7", "comment": "Malware payload", "value": "552d98f29ee6558d55ae0dffc555ff15a6fa79cc0b4982b9d17bfb5eb095bf8f", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768692691, "uuid": "6fb00aec-66c7-412e-9eb3-db75a4443125", "comment": "Malware payload", "value": "7a4cf40b9ff5bff433e3f00932a19c0e7cd2ffca", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768692691, "uuid": "8c943ded-f736-4fd3-be4b-13dad13e7b10", "comment": "Malware payload", "value": "bbf0e7a4a06b3efd7b6e439a5d37b7108317d0373ff4d08c595a87622f1e87a2a1383dbde1a399f097f49335acd56700", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768692691, "uuid": "65fbfd1c-bac2-43cd-b8bd-dd913152e9b7", "value": "T1B3A6CF1EBA5D40E5C1BFD2799A97540AEE7238D1033992DB67D19E190F23EF09E3A700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768692691, "uuid": "215b822b-8324-409e-86a4-3a7848a7c7a1", "value": "d54a3eb32da6c4d0fb871f634df88c72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768692691, "uuid": "986a6310-57c0-4340-88e4-3edaf62c30f9", "value": "196608:Wr75z31Ul22C16UagtWV6KRSZteVUOFdTA1hc:Y2C1FXWQOSXOfJg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768692691, "uuid": "3f22d405-ae5f-4d4b-88d4-cc8d599e5897", "value": 9703424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768692691, "uuid": "9cda5956-35f1-4b16-8791-5c654ea0f333", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768692691, "uuid": "67b28e75-f8b4-451f-996b-d152299f3447", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5da7b0d1-f3ad-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768658637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768658637, "uuid": "69e72dea-21e9-4303-858f-662372e0eac7", "comment": "Malware payload", "value": "4962eb09aecfa5a4332f24d6e75350a5", "object_relation": "md5", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768658637, "uuid": "c5c770ae-c9cd-4e07-b89a-78b732be068d", "comment": "Malware payload", "value": "556fdc9932afc5f176803ae67dbc3b9e54c611f1b720e1140ec540e2d151396a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768658637, "uuid": "64012ce2-f05c-48a3-8ed8-8655b9c85ef3", "comment": "Malware payload", "value": "7648b43efc356d21ceab64caf3dde0dffced233d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768658637, "uuid": "1cc57b2c-5399-40a7-b45f-ad4c902e780b", "comment": "Malware payload", "value": "4abc44ca4ca3ddc5cc7652e25f6c611cf1e63eec985e52a24fad55e3f28aac98608060c987a70f266f4f268fba64595c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768658637, "uuid": "09e9fa71-5b62-4ae9-81a5-7e27183a385b", "value": "T1DA854B606EC64BC0297C47D669E36468CBDA69BBB6CA3C59128C4515304BFE0F1F4CBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768658637, "uuid": "c64b9a9c-1f56-42a6-9944-f7e409704741", "value": "3072:/u5dqRTdoAlkwu2Xbhl3owhmp0twnpVAXf09p9uWXdut7+RVpxRt3j3oKKCf0hIx:gr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768658637, "uuid": "e773c17d-769e-4f67-b349-9f7aa7ca30c0", "value": 1819906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768658637, "uuid": "070022e1-3435-4ee7-a92c-f44e07536344", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768658637, "uuid": "7d296b83-f05f-4f48-a40d-bd88bbdd8655", "value": "pointyrelight.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edf94fea-f3cb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768671764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671764, "uuid": "5b3fbdbf-a5e1-4059-a113-a677f4ffd1b1", "comment": "Malware payload (Mirai)", "value": "21bee2891d423a111a0125cd2846bb55", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671764, "uuid": "a82398be-3d44-418c-8a4b-28c591ce1688", "comment": "Malware payload (Mirai)", "value": "55919d40f7226f53a9f65dcf53f7745b2f453a30ae9ca986998b54f1498f36b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671764, "uuid": "ea86c391-f39d-4f86-b79e-2ff7379ce5a7", "comment": "Malware payload (Mirai)", "value": "242bc8defb9e4aa7dece4d6c99965d88d316ddf4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671764, "uuid": "9a8d370a-d761-4966-98e4-50e02bc6ccd6", "comment": "Malware payload (Mirai)", "value": "f5b1ca20a74ae6ad51724c64a3b386a165f0011c01b3124cf03f37c86f765c143457591679ec16ba7bf681ce7e3e941e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671764, "uuid": "064c7d31-d8eb-4937-bc29-690943a389ef", "value": "T14D13E5D1B8C2562BC2E023BBE66E558E33A163E8D2DF7217CC112B017B8991F4D67B51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671764, "uuid": "7093f1ae-f054-4e8a-8cc4-538deaaa3392", "value": "768:enXYO5X/ZwKq0MRXcuBMWzIkWkpgcQAXCw/gGD0XJHnMUU2c:cnX/GKRMBBWkPD+JH5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768671764, "uuid": "d91c640e-2c94-45e5-86fe-6320d3482219", "value": 43076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768671764, "uuid": "af0ffbfa-0517-4f11-b88a-a47d2b72de1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671764, "uuid": "f58a6698-c7de-45e2-8449-1df83c98c7c1", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a368d8bb-f3a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768655318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768655318, "uuid": "7e51a556-c6f9-47dc-9df3-5bf8b26ae3c7", "comment": "Malware payload (Mirai)", "value": "b751b9a2cd5278c05674443458a9d43b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768655318, "uuid": "dafe6ea2-3911-49e9-9b55-94480b3aad5d", "comment": "Malware payload (Mirai)", "value": "592dd611496ceb76740d70b012ebcd5799bf88eef9cc11986c63c0913c85ca42", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768655318, "uuid": "946f11d6-1add-4833-9669-1272d22a9d22", "comment": "Malware payload (Mirai)", "value": "9646a76d053305929851aa2ed518202f3aaa7cf3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768655318, "uuid": "1cba4f68-309d-4c6d-8c8e-9b4cbf073650", "comment": "Malware payload (Mirai)", "value": "ea5630120d4224d3aa26575051bac147f8304a6f066c2938a1b47ca77be9105f049face220130abf142ae58224cdc606", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768655318, "uuid": "c6d4bedf-34d3-4be4-bb18-7037eec12d1d", "value": "T117D32905734C0847D2672EF03A3F23D197EFDA8221A8EA45254F9B8E9172E734649EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768655318, "uuid": "e372d607-9a5d-4d0f-a311-06b2786c33d6", "value": "1536:H19xwvxhOxs4PvIKkDYQ88FK1cvA2vCgN0d48nxqsSk0PpN:H19OxhOx7xq86K/2AShN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768655318, "uuid": "dbdf0178-0764-4b9b-aa06-7bdc21d01656", "value": 134516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768655318, "uuid": "2a30e33a-4a45-4a70-834c-7a4024f629fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768655318, "uuid": "a158fc07-9549-4f4e-90c6-a44bf5203deb", "value": "ub8ehJSePAfc9FYqZIT6.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "649868d4-f341-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768612263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612263, "uuid": "24088daf-3f0f-43f5-8fbf-22e76647876f", "comment": "Malware payload (Mirai)", "value": "36f1b290f29d4a85e60d49a5264e5903", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612263, "uuid": "9ab644ac-fd20-4a15-b742-c2695d77fb7e", "comment": "Malware payload (Mirai)", "value": "59c16448c9dffedf914627e3a445db90352f043688243e4b65a1a439736c7d64", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612263, "uuid": "ff13248c-479d-491c-8c9d-85901cb191ce", "comment": "Malware payload (Mirai)", "value": "718f280c818c71ae88127bd87deddc2f909c6d95", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612263, "uuid": "a4de4ff3-a754-4fae-a42e-b9f5e6f75e58", "comment": "Malware payload (Mirai)", "value": "4b2676736a7d42f1e92fde6708c3facb9dce6e6ed9815048417f4b3a7e0a15336c00cc3ded4c0ea6225a674a17b23f8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768612263, "uuid": "6d7312a6-783d-47a4-a311-b803d238b2da", "value": "T15D2309C8F443D9F9DC4A09742036FB2BDBB2F6BA2329DE43D7A495236C51702A805D9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768612263, "uuid": "e5c75836-2fd3-4fc0-b27c-bc668774683a", "value": "1536:6nJRT4QPfZfW5XTOeY3Dve3AGAZq/4Qw7bn2iue:Gv4QPfZfW5XTOeoEz0qAQwf2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768612263, "uuid": "33199256-02ad-439e-946b-f4d2eed0d073", "value": 49936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768612263, "uuid": "531b620d-a800-4d02-9694-c217164c83c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768612263, "uuid": "f79e56d5-d1c4-4f31-ada3-05ea85332dfb", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "098790e1-f3e8-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1768683836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768683836, "uuid": "210d48e3-d2d0-44e9-bef9-395a1f712035", "comment": "Malware payload (CoinMiner)", "value": "685a8bf6b260fb39f1896f30fb52b1fc", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "test1", "colour": "#2A4CB4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768683836, "uuid": "9c78695d-8025-4711-81ee-ef052f32c618", "comment": "Malware payload (CoinMiner)", "value": "5c9e44717a29557ca8501ddbffe1b7bbe6815c06c306b064ab5943f694f6d01f", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "test1", "colour": "#2A4CB4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768683836, "uuid": "ffb0544f-d71a-4db9-bdf3-9ff5f3c77bbc", "comment": "Malware payload (CoinMiner)", "value": "7795c62a11f4772412670017324ccaa015c21759", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "test1", "colour": "#2A4CB4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768683836, "uuid": "9275504d-3dc1-4452-97e2-33f5b06dddad", "comment": "Malware payload (CoinMiner)", "value": "0bf92e08e5d1d32034f88b52f0361fad1e1fd038156e98c1712c99b8d8bf06ce38bab80b5efccea1beed0ed75a031042", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "test1", "colour": "#2A4CB4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768683836, "uuid": "19e9e112-9902-4c53-bd9a-1621a2c9a389", "value": "T12B3633D237E5FC78C59239BF68E15EA5A6F379AC270080D7AAB0193E427DDF02634119", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768683836, "uuid": "f4593962-bb50-4af7-840f-60b74bce9ffc", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768683836, "uuid": "f5693dc4-dd2a-4c66-a620-51e3ae96429f", "value": "98304:eq5ktjEW7Wf+Ffmr4oHMuoVYwCTSuOSMnN9tbe8l0KRXyWLDfCumgFAl+xW8:eqSEWk+u4oHMudSxxN908l0Kg6dmgU+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768683836, "uuid": "b98161e8-3e8c-455a-b78b-37ab3e1c51b3", "value": 4920768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768683836, "uuid": "35ca40d1-2149-4db5-899a-bfdf3fe4e76e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768683836, "uuid": "e467ee38-b3c0-4314-a55a-720b3caa0ed5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f968507e-f3a3-11f0-a129-42010a9c0007", "comment": "Malware payload (BlankGrabber)", "timestamp": 1768654603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768654603, "uuid": "3f675e6a-b734-48ad-8b07-eba4e980ed77", "comment": "Malware payload (BlankGrabber)", "value": "4347cdae065ce6530eb58989b4b9d3b4", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768654603, "uuid": "1246f4a2-325d-4d5a-abcd-3bd546672bf2", "comment": "Malware payload (BlankGrabber)", "value": "5e217d93abdbbcf93d8f2106a72d67a3642a9df28f5a705be7ec6b9955aa62bb", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768654603, "uuid": "a6a8f9c3-fb49-42b4-8775-44f4c71cd0c5", "comment": "Malware payload (BlankGrabber)", "value": "8a4b17dcab1a438785d6142ac680f3365f1b7109", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768654603, "uuid": "7a885c92-4b51-473f-b060-e192b427c1a6", "comment": "Malware payload (BlankGrabber)", "value": "9f38d4dde2f36d1be66a0861580afc92a6c1d21c7de8838a9c372837c430b4ed7729294263dfe53024fc4c98a06043d9", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768654603, "uuid": "09e3061c-3d6b-42e8-8f26-8cd091b071b7", "value": "T1BAB7330063B3C46CD6A2093DAC9D1B98AA495CB3410FBD91E2C27E7997340D7F69AF71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768654603, "uuid": "8ada5505-2a90-4774-83c1-846f86497e49", "value": "c58a6fdd5514cc5114ad09dc07384b11", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768654603, "uuid": "7de2dea7-17e7-444e-b98c-17087638973f", "value": "786432:qUXj82vGRCYZkSLcsp+nakZDQIHxoj3uZIQ8deYFcY+TyoFj5r9OZ85cmLw:hXj8xRCYqXsp+naRru2ldeYLEFZ9Kxqw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768654603, "uuid": "c739eadf-a928-4ad4-92b8-a93fdcd96798", "value": 51324217, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768654603, "uuid": "12a490f4-63e1-448d-9923-4abe76ea1da3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768654603, "uuid": "eb579f14-3a39-41de-8071-604e4cf2015f", "value": "\u516c\u53f8\u7b2c\u56db\u5b63\u5ea6\u73b0\u91d1\u6d41\u91cf\u8868.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da20091e-f3a8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768656698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768656698, "uuid": "242fda84-7c3c-43c4-8edc-67897d9c7d65", "comment": "Malware payload", "value": "9c7b059c4139e2ee5f585fa5ce53cd44", "object_relation": "md5", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768656698, "uuid": "ad36d8d6-6857-43fa-a3be-e0ad7d62a6ce", "comment": "Malware payload", "value": "5e36effd41f763df989ed88646a35192b01d054afa40461d1e2847c887e16e4a", "object_relation": "sha256", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768656698, "uuid": "367d8637-a1cb-43c7-9fce-168497a3e0eb", "comment": "Malware payload", "value": "918361c1764f2392c90b2a75be0a681018470a90", "object_relation": "sha1", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768656698, "uuid": "384953a7-ea99-4c47-9608-02cd2cee06d3", "comment": "Malware payload", "value": "67e47308204847fa44ecfad3788a1c5b5c5e75becc08da8515de182279ce0f5d678a42765f2e86a0f836b1539a580e41", "object_relation": "sha3-384", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768656698, "uuid": "8eea3c88-1235-4701-b9f2-37fa2ef79f74", "value": "T1423733E6E5207600F9DBC831A9EF3A07E9BC50C691BD59ACE0AC67D65C4F7D1B628103", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768656698, "uuid": "fa34ff99-6978-409b-b40c-71bffbe12511", "value": "393216:IuFCoZ7Tjefenl802SSreWX/lQHlVf95Kq5sDqhsaRpxfgJBb+y+H/bAbVWW3C1K:PrZ7Tjz2SSyGNkt9sap+AAxWW3C1Z5W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768656698, "uuid": "f6126a4b-fa77-485a-9715-e8e5ac1bbac0", "value": 23076154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768656698, "uuid": "c0407bcc-8605-486b-83d6-3b3d52b9f5a4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768656698, "uuid": "99589385-49fa-40fd-81a2-75a70605d17b", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38ca68d0-f3cc-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1768671890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671890, "uuid": "3d3518e5-1713-4de8-b2f1-183bf933f0ec", "comment": "Malware payload (AsyncRAT)", "value": "eeb6c1380d7149c6008240373188a34c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671890, "uuid": "f06792ee-2fe4-45ee-ac65-f6ea195e347a", "comment": "Malware payload (AsyncRAT)", "value": "5faef6bc1831413de7e8770d6a0d2e1181f948a88d63e65d9baa49e26f29cdaf", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671890, "uuid": "e32e2d58-0e3b-4c7b-9ebc-624886dd13ff", "comment": "Malware payload (AsyncRAT)", "value": "73a887a81bb518e4e015ec9ce1d8c6c950e9bcd7", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671890, "uuid": "fe00f872-d9ef-4d6e-a167-82122204b72d", "comment": "Malware payload (AsyncRAT)", "value": "12f1874de4e52c44d0c62d75632d7c6c06674cad02caf450df8357e4443aeed9e3c3914b55248e19fd8cd3044c3a24b4", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671890, "uuid": "1991b5ee-524e-470a-af46-930dcf4311d5", "value": "T1C1333B003BE9C22BF2BE4F789DF26145467EB5672603D64E1CC412DB5713BC68A426FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671890, "uuid": "3c22658c-4e1a-467e-a959-b15bca2b5502", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671890, "uuid": "1c1d02f7-cb85-4209-97ce-a4adbed55269", "value": "1536:SuTHT5TXfQ29jEzGbMXS0sEBnQ/E2dT3sJUBi:SuTHVTXfQ2hEzGbMV+/E2x37i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768671890, "uuid": "9b3f5246-7d88-4b7e-9df9-4559161b0d24", "value": 53248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768671890, "uuid": "03013085-e351-4f14-aa0a-3d2371915eb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671890, "uuid": "41ffac41-f99f-4a54-aa6f-7be3a860d070", "value": "Notepad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "343a9d41-f341-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768612182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612182, "uuid": "ba977884-b868-4ecd-a65a-6e0bfc9d0b3f", "comment": "Malware payload (Mirai)", "value": "25c26990a7541faacd471ea047788a72", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612182, "uuid": "05431f1e-2962-4879-8a7e-24d1cd30e0be", "comment": "Malware payload (Mirai)", "value": "5fb660db6a93dbb7d9db3f0acb00947cecfb38bb8cddc0b5c8d4a5418905f085", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612182, "uuid": "2861ad51-02dd-4ff4-bf3a-97bba7b7f19a", "comment": "Malware payload (Mirai)", "value": "c78104befec3b6b228af766b59a02020962f1816", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612182, "uuid": "6fdf9fed-f196-4e67-aa8e-e69b3e7b266e", "comment": "Malware payload (Mirai)", "value": "dbbb45271496d81a5c029940e005a0573bce6c19a4c069aa2fdb0b3c87a1dcd32b9855e1f0174a678ca9da7ef72c4d38", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768612182, "uuid": "2280501e-8c08-41d2-95b3-a74c2af4f464", "value": "T1CF330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2757BBFDA36C721A45E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768612182, "uuid": "f6ff9ea2-a888-4ff0-b88c-39f045a5fd74", "value": "768:gduPBFnHooqR8qOCKq2cH4Fje+TK806MMUVjzMfQXOtHud2oGy:r/hqaJMcjeqK806MHdMfQXoHuCy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768612182, "uuid": "8b941fae-25ca-480d-a29b-70fd17cb1347", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768612182, "uuid": "98c3afac-911d-46dc-b87b-d8824b01dfe3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768612182, "uuid": "19067c31-cf18-42e3-b7a5-7530899d4106", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3819a424-f38d-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1768644830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768644830, "uuid": "8f186a9c-ea53-4529-bfce-5a0e6ec16301", "comment": "Malware payload (SalatStealer)", "value": "18eac3c8ed495684da8ee26326cb00ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768644830, "uuid": "33cb480a-d069-42aa-989b-b7baa12eca4e", "comment": "Malware payload (SalatStealer)", "value": "61695cb224cc8d3aeeadaf500fbbfc15978dbe967a9083b1352480fa3ee0d3f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768644830, "uuid": "58290aed-86d5-4737-a3b2-57c7011016f2", "comment": "Malware payload (SalatStealer)", "value": "269d58c31f244c02a782d40d2bdbddcda3790f8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768644830, "uuid": "aff324d2-5a34-4ce5-8f0f-1353d0913fce", "comment": "Malware payload (SalatStealer)", "value": "9f13a84517ec8090d8b87f122f9e03d89a2f1381831c14dc55bd45526f897d88fcd9548cccc864e637243f789caf5dc9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768644830, "uuid": "e7b23ec8-8e0a-4e77-8e5a-f5bc5a167938", "value": "T1CC468D09A3904AE0D137EA74CA668332D77078524735CA4F5598E6162F33EA0AF7F72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768644830, "uuid": "379871e7-f107-4934-abd1-71e30e38539b", "value": "c56f72242a8b4b923219f61658b052ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768644830, "uuid": "c9fcf59c-025a-4c0d-9a28-94d1dd8a5f73", "value": "49152:zkWwAEoWX16olU4PruZlmXSJV2fWNP8tcEPuURU2C/DOVQBiNZsXxH8i4PU6v738:nEpUJ2fWawL+/VmGl+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768644830, "uuid": "f197c743-0e89-486b-b52c-ae366b272617", "value": 5855744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768644830, "uuid": "4e872a29-9e70-499a-8e00-14d630205c4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768644830, "uuid": "d95b32ec-7176-4f5c-8f35-4b2028d59e27", "value": "Blessed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccebf4fe-f3b5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768662260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768662260, "uuid": "e16cf8c6-0163-4332-bb14-d88ba5e6aa86", "comment": "Malware payload (Mirai)", "value": "a6c4df105e42c5265f4de5cff5f61a06", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768662260, "uuid": "a164152a-2c74-4e3e-b58b-fa58a4222618", "comment": "Malware payload (Mirai)", "value": "640b76e1981ed1aa54bc7134f2dd139474ef3644743b0a97cc839e17467797eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768662260, "uuid": "2e8051e6-1bb9-423d-935c-408f4ecece96", "comment": "Malware payload (Mirai)", "value": "484225128f2e200aba65b0f3c5c4729fea30bfe2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768662260, "uuid": "2fa66aa6-646e-4913-b363-759e2c9be312", "comment": "Malware payload (Mirai)", "value": "06840a6c565edd2cd3bbf55d324432f9a490422502edde78aedfe926c120e1cdfeadd080825daad41a27f7b4b5b75f19", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768662260, "uuid": "c9148bd6-fd4f-40a3-be48-8397eb29918c", "value": "T1CC230261890E9EB124703C76DAD5E39376E02A71C6673013D62C0B3C6FB9B531E57E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768662260, "uuid": "20e59865-2c23-43ab-a4eb-03a6c1da6d56", "value": "768:g/TYCoIxdEk+AxoTZAZHFeq8b3i9q3UELbUXfi6nVMQHI4vcGpvl:gECFd+A6YHAxXLRQZl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768662260, "uuid": "3be5a039-2e6f-4639-8288-b7cae202fee3", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768662260, "uuid": "d2a5cbd5-da1a-44e2-b286-dcc85a637af0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768662260, "uuid": "6888d835-70a1-4fec-9995-3725e197979d", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f53b796-f341-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768612281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612281, "uuid": "1e4c28b4-b380-4736-9631-c3b5919ffdc0", "comment": "Malware payload (Mirai)", "value": "3f40336ae62ee8143b7f5b9797f21904", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612281, "uuid": "7117720c-6e34-4a25-8e65-47da6dfd4cd2", "comment": "Malware payload (Mirai)", "value": "6420ecb81ecbac578adeb6c7b2e968e9a812b5d9974ca2a4546ac86fc8fcf066", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612281, "uuid": "09cdb905-5590-4fdf-890e-6902499ced1e", "comment": "Malware payload (Mirai)", "value": "da453e93f763e3dcca377627147703cae203ac02", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612281, "uuid": "40b7094d-0114-4418-9629-439b87b012c1", "comment": "Malware payload (Mirai)", "value": "2f1b29502c93c2a37c3bcd26a600c904cff6ab130a798a08f132c8306a93b82d95c358db2451ca32efdfd5d2e665673e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768612281, "uuid": "8d1b8523-480b-410e-b747-a3fa7812800f", "value": "T17FB2D03C1B111B98DA1EC1BD839C1B203CB81F3591829D4B6217EDD7AF5A8743453BE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768612281, "uuid": "d688d7b3-6ef7-4e23-a31d-be41c7127ae2", "value": "384:6eD8ZSH2LLZUYyGZbsOiTrowSN9rnZMINlphQ/HYtuiqscrzDmd1JgGlzDpH7uNT:6eD8ZSWvZHZbs1row697qohQvg927i1c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768612281, "uuid": "78e6b602-6088-4449-980e-49e2fe2eca94", "value": 23784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768612281, "uuid": "554a316f-80d6-4281-b985-ba1b0f324cfc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768612281, "uuid": "d7afeb19-5909-48fb-8c46-12c5a6493d59", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fa9fa27-f3d9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768677458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768677458, "uuid": "51cee99b-f81a-4bec-9a9e-3e235e162c65", "comment": "Malware payload (Mirai)", "value": "c3dec9bc830e887e90d84575d61b0eb3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768677458, "uuid": "63feabbe-c36d-45f5-9441-feb50570a4a0", "comment": "Malware payload (Mirai)", "value": "647c66c097beee40e81a12fb552cb717581ebed23012e87f9e452926db0e60cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768677458, "uuid": "c321a56c-f7eb-439b-902b-9de7c8e4712f", "comment": "Malware payload (Mirai)", "value": "87dcfb4c967928971d0394665cc1a6116875630e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768677458, "uuid": "9eafc139-44c6-404d-be1a-272a479fe6f1", "comment": "Malware payload (Mirai)", "value": "400943d63fd3aac554be63b814228bdb872f37e4945e9aa397351a4d4d5eae407bcd66c146155c39e081f509af975d38", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768677458, "uuid": "d3fccbb4-741a-49ca-a3b5-bb6ff8fde39c", "value": "T1CDD36BC9E68FD0F5E85215753036FB365A73ED3A113EDA83C7A89A319CA3581C61A31C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768677458, "uuid": "5d878f84-bf8e-4f66-b636-7dd7d27d894e", "value": "3072:tvSiZhU+FrpjGprib1jFvW33H3zdRPF3:ZSifU+mpRXB9F3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768677458, "uuid": "c9e900b2-4060-4b58-b3b7-6f0f0b2f39cd", "value": 141676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768677458, "uuid": "89877377-3abe-4ae5-b12c-fa7ebd700a31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768677458, "uuid": "b8495375-772b-40e5-9488-2b34318cceb0", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b26898de-f3ca-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768671235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671235, "uuid": "f17c6280-fc5e-4c1b-bed8-30d98e14c91e", "comment": "Malware payload", "value": "47155d5c20390e9c73da6b220527e96c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671235, "uuid": "18e72d58-db93-44e9-92eb-fbee55a20d49", "comment": "Malware payload", "value": "6571d64d37801add3108b1029251a86a113b032d0347174edcd6f51de55a6e9d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671235, "uuid": "da96e4f4-affc-42c3-9075-df0bb5b96513", "comment": "Malware payload", "value": "1c5de1795deab4049c91b051a8f08fc68c265d60", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671235, "uuid": "9dace563-fe24-45ef-9ee1-6b7d538bec1f", "comment": "Malware payload", "value": "fa50ffea9a6f6406f35970adc1c59150169da31df0c380076dcef255359758751fd2b0f4efcf52c3a5292ec830dcf9a8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671235, "uuid": "303f2fbc-3674-4572-9288-dea899b4ceeb", "value": "T18B617FFA02905D3B5CAACAD3A1F80644658158AB18CE0F714BDD2CF83E4CFC83C5AE45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671235, "uuid": "3cadeb4e-f3f7-4971-953e-53483fe23f47", "value": "96:iXXyXmkXJyX6EXUsX8YXDuX/CXkGLXByXqwXsoXxiX0q0BgJsX4ck:5vBgJ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768671235, "uuid": "da520e61-dd0d-4863-828e-62d94c2b78a3", "value": 3374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768671235, "uuid": "1777fa6f-1536-4347-b51b-0c2d1085d158", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671235, "uuid": "c6900880-9ddd-4f07-9e08-73e60762476a", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e59bfb78-f3aa-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1768657577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657577, "uuid": "1437c8b9-b5cf-42f5-ba42-fb554cf905b4", "comment": "Malware payload (Vidar)", "value": "3183d5776a6f82d46bf8bcfb91d72a4c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657577, "uuid": "7f2751a5-93e8-4f00-8665-64b238541187", "comment": "Malware payload (Vidar)", "value": "679245963675686433c8e2615e693447f56fa9e20b19b9dfce31e4705276212a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657577, "uuid": "0b985888-b1cb-432a-ada3-2af37cbce3ec", "comment": "Malware payload (Vidar)", "value": "ebe9a4885974084dd60182b142a0c4bf6ed376af", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657577, "uuid": "93e304ca-974c-4ff7-8947-26457e82fa8d", "comment": "Malware payload (Vidar)", "value": "910a12bf2c7be58073d4ee6986ba9caf67a873d70f2fb879fccf6d3e66dee6754d4afbcfb02acf7e7bee417c90ec0261", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657577, "uuid": "bf8e4935-560b-4188-b73a-0264f94542c4", "value": "T1DF865B92FA404625D29BF23AD9B192857230F144033515D7BB651BA98CABBC8173FF2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657577, "uuid": "3d3bc5f7-8cbe-47e4-80f6-d03b365da44b", "value": "da7f8acb6151c95be088a02465d68ef8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657577, "uuid": "c1f707e4-ebc4-4337-9762-ad3d1e75bd6f", "value": "49152:95+xskcrb/TPvO90d7HjmAFd4A64nsfJ7UDNy89Qg34aMA3R+J9gyK1rH95AMHRz:72UUxMHp0CWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768657577, "uuid": "c69d7855-ca6e-4312-a663-4b06c489854d", "value": 8068224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768657577, "uuid": "e3b06b8a-d9a7-4c36-8e6a-dc190d8f5299", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657577, "uuid": "957e9e7c-aeda-4962-b5ca-3c811b69fbf7", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccfbf0fa-f37e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768638637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768638637, "uuid": "d7ae333f-9553-4333-ab9c-fb3ddaa9765b", "comment": "Malware payload", "value": "86e60861a93e9d12827644d05a46fdff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768638637, "uuid": "a8593d4b-f552-43ac-99d5-aee8bb67f2a2", "comment": "Malware payload", "value": "67a091dddac43f6eafb45930ea190e9e8015c632683ae5df182d22fdd4248eec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768638637, "uuid": "8372487d-30f7-4f0f-b984-17fb5eebaf90", "comment": "Malware payload", "value": "306fef497c0c89ce3f6fe7541eaaa846537542dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768638637, "uuid": "89feee74-fb97-4883-aae5-86c960aad1f2", "comment": "Malware payload", "value": "d580286ec366c19f51598acafae6dc119b2a127b1c00ff2a8020a07d3e7b858e874fe0d1e071b809ff5c9b5cebd5bd27", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768638637, "uuid": "0dc4e56a-b02f-49e1-936d-1237cac50bab", "value": "T10BE12382BED6CE3BCCA9627A1673C6203372C551AB439B17210C48753D83AAC6D76B95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768638637, "uuid": "93f4012c-7b69-41f3-bc68-3d31ffa25619", "value": "96:8xJFWLccScsYLmg/vdpklpqxMYc3O9Ff721a5BI31HBgVcgOu8+TiImDW:tccSvlg/F+QGO9FfN+1H6VcggDW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768638637, "uuid": "bf61dc35-e5b8-447f-86dc-6a2409f353b1", "value": 7316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768638637, "uuid": "1e075ac0-abcf-41d5-b403-1b723d0a502e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768638637, "uuid": "e9e3aafa-8aec-4427-be81-e8a334525a37", "value": "SecuriteInfo.com.Linux.DownLoader.2312.5449.30421", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fb9e566-f3cb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768671525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671525, "uuid": "fc073080-c36b-45ff-8ff0-a4c0d0acd508", "comment": "Malware payload (Mirai)", "value": "c63840ce129eb124fbb03bd876c84c13", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671525, "uuid": "0c7f16ce-9957-4921-b03b-7f181978ade2", "comment": "Malware payload (Mirai)", "value": "67ce19f10a7b8d101db9c24799d5bd05168137fdfd78aef127c6a2394b07f7b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671525, "uuid": "d23b3e72-36dc-4061-8652-1cc86c561838", "comment": "Malware payload (Mirai)", "value": "8c8e7bdda50e0d84f552d475312629a04afc4fa4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671525, "uuid": "ba4a7b7b-1f73-4061-88ae-f3afbbc063f7", "comment": "Malware payload (Mirai)", "value": "bdf04572e7497f6b7fa9786cf2479f03c538254051925ea6ba99f6deb1f6ee547337f008010dfd88db257d94316a4ab0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671525, "uuid": "93570250-45d8-428a-aa36-c651c6db5068", "value": "T1DEA33A01B34C0E43D1975DF02A3F37E587EEF59121F4BA85294E9B4641B6EB2258AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671525, "uuid": "8e8d3c90-0379-4120-b7bf-158ee451bbfe", "value": "1536:xJxTqiccBVfhZY/rn/RU6yv1Pb+/cQrNO2qmrW:xJZUcBRD8pzyVbi/rW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768671525, "uuid": "08a28fb9-72a3-4fc4-b3eb-6fe563b55e41", "value": 99940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768671525, "uuid": "f25212f9-fa00-4e00-93c2-e8d13bd85d11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671525, "uuid": "909aaf86-3f90-4f05-a912-0d8955e71518", "value": "windy.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94973049-f3c7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768669896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768669896, "uuid": "1dc78350-f349-4b1f-81d5-782572b4ab33", "comment": "Malware payload", "value": "3fc195a8e67e5a77a848673a1703e7ed", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768669896, "uuid": "cdaa0d94-33e8-48a9-856c-35c4dea17b14", "comment": "Malware payload", "value": "68e81b51336c63dab48d50cf51fb098d16936969d0241874a427900cae21b8bc", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768669896, "uuid": "e241deed-8a80-4e0d-8524-0a3189fd5372", "comment": "Malware payload", "value": "41e8b47f3f9ace4b002fe4e51d9ea763a95aaba8", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768669896, "uuid": "a54b15e3-d4d6-402d-ab02-fbc961bc465b", "comment": "Malware payload", "value": "00226dbb3bbec4a0ace1066f8863083e0845ceb60cfccd37e90c3c9d95adbdfebaf2b414a42ff94d537cd9f1ebf768a4", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768669896, "uuid": "84968160-eb3e-439c-a8ef-37660d5e2c7f", "value": "T18A3533710D8C8C8677DB52717BDA89831920A4DADA1077A653C2DDCAFEF583F8508F29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768669896, "uuid": "2db82d5a-a7f4-407b-856b-b02effb7130f", "value": "24576:HLEqq+G/H3/YrjM9nkYHAIfntYxccIGnT42deFdd4:rEhfwrjMeYr+xIGn8zk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768669896, "uuid": "3518873f-e540-4140-80d0-7ff841e4b6d2", "value": 1139429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768669896, "uuid": "5871cbbe-cbd2-40d8-ab92-df369014270e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768669896, "uuid": "c32097ae-3287-4da2-bf13-4985c040872a", "value": "Coinbase Vmed Lines ( Data ).rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc1119e0-f3e2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768681666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768681666, "uuid": "17a8a594-d830-4774-a5b4-90f28ff71372", "comment": "Malware payload (Mirai)", "value": "ac9e6a5eb3fc2ac2ffead1d45a907e06", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768681666, "uuid": "10da2624-f3bf-4a7b-aa79-cedcd98399cb", "comment": "Malware payload (Mirai)", "value": "6b70529198f46f1728db2a00e921f589b5202b4b4674915296ae26a425840056", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768681666, "uuid": "daefa649-a482-40fe-816b-e36c0ad07ed1", "comment": "Malware payload (Mirai)", "value": "74f52ebc66d074253cf76e2124849fce0b296652", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768681666, "uuid": "91f2452d-4163-423e-83a5-f54ac021ffef", "comment": "Malware payload (Mirai)", "value": "93aec96114de2da481d440aae5c336967e7ec65fdb5ed3ccf126d9d008207f4f353b57f9a40a91dc2a8151b77a518750", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768681666, "uuid": "e121d584-5ee6-4287-b587-33ce3c5f38a9", "value": "T17A040846F8C18B11D5C111BEFA1E518E33235BB8E2DE7212AD256F60778B8BB0F3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768681666, "uuid": "d85bcf74-9a72-4e42-bc5f-234707f02f42", "value": "3072:K9Bd7uqOctV7yqlV0BQ+1uqXKXT/x2ZaYdNPBB3Aqj2OQh1oA:aBd7uqlzTGFMVXT/xKaeXAqqhh1oA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768681666, "uuid": "74fa9e10-1fff-4cdf-b5ac-3c9608b0e2b1", "value": 189180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768681666, "uuid": "7f60cf45-8453-4dcb-9442-9aa8e2602f2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768681666, "uuid": "7e6de024-0d96-4416-9a22-2f74e330e8e6", "value": "Polar.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe9cb2cf-f3ac-11f0-a129-42010a9c0007", "comment": "Malware payload (Arechclient2)", "timestamp": 1768658478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768658478, "uuid": "6113775c-5885-4ddc-8a9d-f68993589462", "comment": "Malware payload (Arechclient2)", "value": "9f3bca3d9f3bcb7f22bde0a18fc8f61b", "object_relation": "md5", "Tag": [ { "name": "193-33-195-32", "colour": "#796955", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768658478, "uuid": "34e111e3-2e95-412d-9261-8a6d8eb2dda3", "comment": "Malware payload (Arechclient2)", "value": "6bb3fc2dfd84c35f5435963b1b73e23da98dfcd4ca0d121e8aca37a551ae58e9", "object_relation": "sha256", "Tag": [ { "name": "193-33-195-32", "colour": "#796955", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768658478, "uuid": "a3bf375d-2689-461d-b4c0-975e845a7b73", "comment": "Malware payload (Arechclient2)", "value": "c27fd881f1c89f59b9395830c8de072feedda289", "object_relation": "sha1", "Tag": [ { "name": "193-33-195-32", "colour": "#796955", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768658478, "uuid": "a1c4ba68-6445-4af3-bbc1-d74b498fa1cd", "comment": "Malware payload (Arechclient2)", "value": "307de58c7eb9806c7c7def847cd078952af5a8f778066ea5e1a414822ed040665445c0052282a814d64dc6723ab94ceb", "object_relation": "sha3-384", "Tag": [ { "name": "193-33-195-32", "colour": "#796955", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768658478, "uuid": "2e7127a4-0a48-4c70-a1e8-0d23f0c852aa", "value": "T1B3756B646EC39C37928567EBCAB39758EC90928E4E15BCCC75CDC1F0259CB0C87649AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768658478, "uuid": "5e44a18e-9c5d-44db-896b-aab7d20afb39", "value": "12288:Br3/C3J7Dyx1+TPCZBP28jc8/VfaROMhTj/u1D6LLhrRpOqn1Wzv7QM0Q8IQ:5C3QPbZB+vaVdqi1DQpOqS7QMN1Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768658478, "uuid": "3217956a-392d-443d-bfa5-c1b65281cd15", "value": 1665509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768658478, "uuid": "eac869f6-7264-4f6f-bb1b-e4b2b7415444", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768658478, "uuid": "4d45f920-289e-4655-a0bd-67d2ef3aae48", "value": "almcjzdny.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "615605dc-f3eb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768685272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768685272, "uuid": "215e8762-c011-451d-a16d-78c3a0e64498", "comment": "Malware payload", "value": "ac0b438548a8fd252ebc2bb84c43391c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768685272, "uuid": "be15c72e-9812-40c4-962c-c57058aa5b5c", "comment": "Malware payload", "value": "6c4637db01e41486fbd7f70ed5707413092d837fca04983665f8b90f29979617", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768685272, "uuid": "e38664f0-5add-48f4-a364-89b9be88109f", "comment": "Malware payload", "value": "07f11765d408bd741aac4fd4820ed56e2996a22d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768685272, "uuid": "53e176e3-083b-4b4d-8794-43d371aaaac6", "comment": "Malware payload", "value": "fc5b2b6c235ac2c0113ad07c74f15f820105533066c5201381c47e677c95bfdad11285ef896ab68201b8b48cbba11cec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768685272, "uuid": "c1a7ae0c-b596-445d-b286-b82223bc58e2", "value": "T14CA57C0BEC9209FAD26B933288E62592B7B4FC490F2227D72A5076393F727C56D35744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768685272, "uuid": "03e24194-995c-4eb3-88c6-5291b10bf627", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768685272, "uuid": "c84266ad-bca2-48c8-988e-3e6f83dca58f", "value": "24576:564AauJqASQvTGPkFo/2gtzRohsS30wWQ4WB0GMUjeleN4j42CR00:5fLuQASGTEkiftz40b6YUv2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768685272, "uuid": "0e35fa3c-6cca-47db-96c1-f1fb2b116a7f", "value": 2146816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768685272, "uuid": "b34f329d-68f7-4459-ae7b-334022136646", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768685272, "uuid": "9f55666c-17b8-487a-a04a-883b2ef02f36", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dfb77b1-f3e8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768684058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768684058, "uuid": "f89e1c52-33c6-4b7b-8b71-e0bb7e87f7bc", "comment": "Malware payload (Mirai)", "value": "89c0a0b9ac09eae2fd9b2b95ffd13493", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768684058, "uuid": "68e6590b-c74d-4c99-948b-96e4bc40fdd4", "comment": "Malware payload (Mirai)", "value": "6d1f29395019701e55b0603b1ec4c7c50466b9c9b6adf18ef2112a98f417314f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768684058, "uuid": "52ec0d17-4318-4527-9763-1523e9c39ffc", "comment": "Malware payload (Mirai)", "value": "9d586ea584aeb2557b78efd206ce36d6b5e4a211", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768684058, "uuid": "03686146-d09e-4dac-93bd-660c85c82e5b", "comment": "Malware payload (Mirai)", "value": "9e0f82e2a52afbfe486f892b28c1b34ce56ae2ea5574cdb3cc31b5faf1d9b07200bceb6d9a3eaed4ab154ec5d0fc4a15", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768684058, "uuid": "94c6c62b-060d-4788-a173-cd5c2da2205d", "value": "T106045C02771C0907E1672EF0273F67E193EFD99214E8E744654FAA8E9172E32158AECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768684058, "uuid": "7ccdd468-75c5-4857-9201-dc9348c3419a", "value": "3072:3fnUiipKh+9tdFmd9vCBRMJVtxtKLEVXA3P64kP1f:PnwALxULEVXSPvkP1f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768684058, "uuid": "71b6fce6-5def-47be-9b16-ee1bc5111608", "value": 176444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768684058, "uuid": "f8b5bc45-dd7a-4fa3-9bef-b2ff36b7ff5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768684058, "uuid": "ec215a1e-6d26-4872-bdb5-fa812641e6aa", "value": "Polar.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef04b8c8-f3b1-11f0-a129-42010a9c0007", "comment": "Malware payload (ACRStealer)", "timestamp": 1768660599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768660599, "uuid": "5f056378-adc7-4043-9dad-8e3dab969a10", "comment": "Malware payload (ACRStealer)", "value": "e91d3a03f2182cfe2e8955087eb4ebdb", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768660599, "uuid": "3df13ac3-9158-4cb1-a873-ad809253ad92", "comment": "Malware payload (ACRStealer)", "value": "6d6c1ede0a02b46a6ffd5366ad86b5934efd20ae2663a12008cfcb3de6a471e2", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768660599, "uuid": "a18e8da2-8812-4bcc-85a1-43a3148adcd0", "comment": "Malware payload (ACRStealer)", "value": "cedeb40a90067dd493d271462001f1943c4993be", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768660599, "uuid": "78fe48ed-dcd5-4b96-b06b-d35070cd06bd", "comment": "Malware payload (ACRStealer)", "value": "fb5408fe570e6aeca2a17c59ba129111be1c3567fc29ebc8a608fbe5bfc4ab668e509ec7581cc72cd97e4d9ef31d9bbc", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768660599, "uuid": "61112937-fcc2-475e-8f14-8793294d4b6d", "value": "T14BA7339CFA8966A4EBD6EEF6E845775D6A63C50ACB62F16FD12541004C832FA0F0F143", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768660599, "uuid": "f917f5ae-b30d-4abb-984f-dad4c534dfe9", "value": "786432:iHSxG0iDnHtwrNzDXe8fUBsnP02NQzHrdA8kl237nAbeqgQwxWMeLRnWsrUJvltQ:9oDmw8MWnsQQy8047nAyqgQd74IetiRP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768660599, "uuid": "30aaca62-c329-4d78-bdf6-08bc32666f1a", "value": 47243941, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768660599, "uuid": "eb36feaf-cf9c-4ee3-85c4-0e64c40a1a8a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768660599, "uuid": "824a3421-2d4c-4e1f-9631-99e3638662fb", "value": "#Pa$$w0rD__2025--0pe\u0274_Set-Up!.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "487c9bea-f3c9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768670627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768670627, "uuid": "6d987b29-f117-4602-823e-c5e75916a57b", "comment": "Malware payload (Mirai)", "value": "0a1e21715d3773ee94820576e919a63b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768670627, "uuid": "481cccbb-7abf-46a0-bf2d-1b5a413f3652", "comment": "Malware payload (Mirai)", "value": "6dfcdbee9cf867ab4040935f745e976d45ed117b90f5c9e27bd10df0c3415c48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768670627, "uuid": "239c77a5-fd1d-4a88-81c9-0d772946d727", "comment": "Malware payload (Mirai)", "value": "cc77aaa58a73e991a56d08aea1d1531cfdccbf88", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768670627, "uuid": "6e83e5f7-65ed-4188-b67f-2fd5ec1fc7e3", "comment": "Malware payload (Mirai)", "value": "954eebc54be7bb72a9d38f970329343a6116bfa2466fc7a694f8fae7d5c847bf270a21af39dd03c9c94b662d81de6fe0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768670627, "uuid": "e4b37dcc-922b-41d8-a47b-5d38aea6f3d8", "value": "T11653BEB2C859BDD0C4008234B522DEB82B53F40996671FB58E8789A55447EFCF61E3FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768670627, "uuid": "50b9264b-4540-467b-9f83-4e353a09cd01", "value": "1536:ua4XhFb4AEfNmnwt1o4GUaZt/NNUXTHBUuvqCUd:uvhx4AEfNk3bOH+uvq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768670627, "uuid": "a88a99be-967c-406b-bd8e-356b5c34f802", "value": 63864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768670627, "uuid": "3b3e4801-5e4f-4f7f-b68c-de5d2ff68a8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768670627, "uuid": "869ccbed-1eb1-4a98-b4cb-4d2ca495bab6", "value": "vcimanagement.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f614d02-f3b6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768662452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768662452, "uuid": "91aa3089-1b45-4fd3-872a-048b4437f04e", "comment": "Malware payload", "value": "0dc7d37de8225cb9ad6f0aa5840a4aae", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768662452, "uuid": "ffce5679-9d28-433f-aaf3-30e0b55d91a5", "comment": "Malware payload", "value": "6e59a69c6d75874df9377cb7e095127d690fdcff5ab88e8f86d155893ab77482", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768662452, "uuid": "62c4e8b3-59db-4316-84f1-b20e8bb0acaa", "comment": "Malware payload", "value": "850252841192322dccd52ff09ac6120b3189f75b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768662452, "uuid": "a20095c0-5200-4a3b-aed9-41875c27f952", "comment": "Malware payload", "value": "ae41b8e04274b84cfd3c6e4df4eab94bb2c9b5c7d674a75ad613e2eb4c41a61d681a8b131861f245d640199f5976a0c1", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768662452, "uuid": "dee706c0-b56a-4946-98d6-902518597d92", "value": "T197B302AB0B3019CD7768F7E5C5D129AC1F1AFE64A55507E074ABD00802BA8C42EF5DB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768662452, "uuid": "646d72b5-792a-48d6-a851-862f8b675437", "value": "3072:4cra1RlcHpCkV7XTjG4r4DDc3yUwSgwGr7gooK/:4X5y7X24kDDcYXgA/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768662452, "uuid": "8695de6e-c595-46ac-8064-7ccfe30dfebe", "value": 113450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768662452, "uuid": "6e8794d5-db60-4c68-aa91-86dd0effc029", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768662452, "uuid": "7585d42c-a324-4dff-a27e-ab5d21ea6cb1", "value": "Offerta_Pranka_M_07-01-26.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac747150-f3c9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768670795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768670795, "uuid": "420ca94a-6775-4d2d-9306-691cab6c6038", "comment": "Malware payload", "value": "9474850297844f973885ee95c840e225", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768670795, "uuid": "0a688a35-b494-4be3-9e6a-399f5cb1da46", "comment": "Malware payload", "value": "6eadbe57e734adbb395b046f0125d73bb03979b35cef799e2cbb44c0d3447aab", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768670795, "uuid": "062214d1-843f-4f44-b347-09c86d0d9bf6", "comment": "Malware payload", "value": "64c2b74e7acf648cdb673653f927c611b2df0e2a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768670795, "uuid": "35bb0415-d9ab-41b6-bf78-59abb69030d4", "comment": "Malware payload", "value": "c216f5dc63823a7e4a9e01b171797171a149c788fa25affe5622fc52a3de7ad655cdbf338d9c9e8cd5da739819a20ef4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768670795, "uuid": "6b35f77a-03ea-4267-a9d0-3b4c2c5f97f2", "value": "T1B3212C9D03E1718AEA130D9D6811C04EB3FEB3E7B7508650AECF5868E0ED2097635A75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768670795, "uuid": "4a47c582-f9e1-48b0-99a8-181c7469c8e8", "value": "12:3J34Hv5U0gv5h8NINMPv53LKUmv5av5tHX+v50jv5VW7NGuv5HQTjZv5fzw+uv5e:3J34/NIKKANfkQTvzw+p6A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768670795, "uuid": "ad56ef8d-99ab-4f57-8d78-1f977404a749", "value": 1293, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768670795, "uuid": "5db0685d-44eb-4f7a-b356-38e20b52ce21", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768670795, "uuid": "f5132468-aeb7-4caf-a0c7-48e225ab2a38", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0372d3f-f3a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768655420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768655420, "uuid": "0b1c1867-f1cf-4e45-bd64-0995c8080323", "comment": "Malware payload (Mirai)", "value": "34a7df5cd7e3948b0daf2a867379bdfe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768655420, "uuid": "5bd4143a-963f-4074-8f24-21da42fdc5aa", "comment": "Malware payload (Mirai)", "value": "70072dd0eb30e6d59d5be0f9e1812c899d002125820f431dab740ed8150040c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768655420, "uuid": "bcb8a257-46ce-46d5-8821-2eecf14473cb", "comment": "Malware payload (Mirai)", "value": "7d8a8ce6cba89599ca8d3004acad0d5892e03ea4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768655420, "uuid": "c4fc8f57-5878-4d29-99bf-6d216ac7e202", "comment": "Malware payload (Mirai)", "value": "44dacb29e98a899a03090dc057ad831dfc2571eeed4b8a4675176350a9fd65911ef70329ec474d98ceebfc1cbe6aa40f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768655420, "uuid": "9b5c3d87-273a-4229-8a42-6a136204f934", "value": "T1AF72CFA8E3556EB1D170863AD67485032B831D9CE6F53013262807197ED1E0362F87FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768655420, "uuid": "36d26e0e-b1cc-4072-a804-59fc527d79ae", "value": "384:8xjru5+HpatwhOD5bTd7/V8AHrnvhymdGUop5hve:NltwhODJRaCrvs3UozVe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768655420, "uuid": "78377482-8bbf-4c9a-8181-42e045e98327", "value": 17560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768655420, "uuid": "0af66d5c-2808-4572-80b4-d69e1d9583c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768655420, "uuid": "796736e6-ba6d-4094-a3e4-f28e0efdf70b", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6e8ef34-f3e3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768681953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768681953, "uuid": "b78bc088-0ffa-421f-8359-cb143e05cd3f", "comment": "Malware payload (Mirai)", "value": "75ce5f70d5338efeb0398a2438c984bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768681953, "uuid": "d47a33ce-dc1c-4828-ad0b-52b987506d85", "comment": "Malware payload (Mirai)", "value": "70a46bf2111e393fda22863bd7449630867cab7023117e0672be2b829f6ff429", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768681953, "uuid": "5ded5380-4fec-431d-b657-09e2274f68e3", "comment": "Malware payload (Mirai)", "value": "03ea36fd5a052e1c9c9a9eb10cc3ada61e54db3f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768681953, "uuid": "c73fbc1e-88b7-4e7c-a787-556959d6dcab", "comment": "Malware payload (Mirai)", "value": "bce1b82a1a408200d0d5a07b75c4ae01f50e63f7024c899eac8050121b47674efab588dbb0e26ce83d7eb764890bd0f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768681953, "uuid": "29f8a403-48b2-44c5-ac26-e91e01ce28fc", "value": "T14943F1D30050FB98C0AD61FE01EEBA5F241494FFC1E2A1DA7370B43A50D9DA56B4D6A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768681953, "uuid": "e6516d93-9df5-4707-959d-baf4d6179b62", "value": "1536:VMiHPjMHGCpfqhzZlRq/HiFG5BQ70uv8gEa2yrnFUXQ9nouy8Hy0:GCPjMHT5yRMCF6CizQFout7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768681953, "uuid": "0a4ac200-648c-49ad-a212-9c7fe711c4eb", "value": 58936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768681953, "uuid": "ff4f1130-ac9e-4c23-85d7-7dd5b7d8599a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768681953, "uuid": "bb4dc04b-f249-40cd-8882-30c2c97592d5", "value": "Polar.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9405496-f3b5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768662280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768662280, "uuid": "f85845b9-0f69-4e92-a7ae-9ac37e2c5a59", "comment": "Malware payload (Mirai)", "value": "035075b1fda9fd4c2f2125fdb1ef3dae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768662280, "uuid": "be18e639-0d8a-47f0-9516-b72154f0f6aa", "comment": "Malware payload (Mirai)", "value": "71bf36822ea35578f0f0a3828d7238d35cef9b79b5a032ddbee42606b20d2056", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768662280, "uuid": "9dd81bbb-b357-4618-ab2d-aefd8098ef1f", "comment": "Malware payload (Mirai)", "value": "be8bc3290501e737310437cc6e71e8e2439db845", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768662280, "uuid": "7e7744e4-d0db-42de-81da-8803a5dcf867", "comment": "Malware payload (Mirai)", "value": "32f7071353ba03c5fe88c24ee06317a4785e16e8c6269fba4975190b03862ca9851ed35310149e16214aa552b7a37bf4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768662280, "uuid": "7524307d-eb19-4c7d-92a7-48bcbd1b8004", "value": "T1EFC35B42FA418F13C0D61779B6EF42493322A79593DB73069A249FB43F8679F0E63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768662280, "uuid": "d54d6f67-43af-41c3-87aa-cc0aaa18e02e", "value": "3072:cowpuQyNSG2eRa1styK9flTQPHozrScVM/9OAvjik:cowpuQyNSG24a1styKdlTuIzrSmM/9nd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768662280, "uuid": "12b41d44-4349-432c-9f26-8ca940b0b4c5", "value": 129940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768662280, "uuid": "7976a21d-d7e2-4f86-b4b2-53e4e4e4e6b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768662280, "uuid": "7e5f9c20-14d3-438f-8748-cf6b9bb50976", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f97dd507-f3ca-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768671354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671354, "uuid": "eb75bb34-2b4b-4d5e-895d-f0eaa33a9293", "comment": "Malware payload (Mirai)", "value": "c6a90fff6ec177e77043b5683b2eeac3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671354, "uuid": "18c28e40-b9b0-42d9-a922-cffd7f9c0988", "comment": "Malware payload (Mirai)", "value": "7222efd9e5d51f4f05bb111e9a23d8b20764d2371b7413caf4efd2c9b8ff4eba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671354, "uuid": "8e0ed23e-606a-4a66-a422-b7402d0efa53", "comment": "Malware payload (Mirai)", "value": "bf3b9f760a8f88219aa337e4d894d5ce8504a7b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671354, "uuid": "3c9acdf3-dfda-40ff-8e48-c83256a20bc4", "comment": "Malware payload (Mirai)", "value": "aad45f792b30b33702dbe6c71b25086c14b4b7a91b3ed1b99f3e31043b00e64f6f7add520604d3cb0cd8a5892e8a42a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671354, "uuid": "5db61091-c912-4f3c-9970-d183b8c3ecb9", "value": "T14F13F14BE7E80951CAA9607879AF720640C8E21E3045B5B1F8CCA53F9C55B25FF06BB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671354, "uuid": "e086e8ce-d2ed-44ed-aef7-ca97a4aee208", "value": "768:AQsUqbdFYJ2sL608I+bF+YsKgexSdW1eMbqIsn8SPjonbcuyD7UGQRjp:L4bAJbu08I+bYjKgeEdW7bBgN8nouy8J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768671354, "uuid": "9420f614-d1a3-423e-9c9e-f629cab702d0", "value": 44216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768671354, "uuid": "4f2446ca-e358-45bc-aa68-0d41151a7d6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671354, "uuid": "c2eae2a2-d69c-40fa-8fa0-d037803ea0c9", "value": "windy.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07ea7dc9-f3b1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768660211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768660211, "uuid": "b0a7f8c3-057c-45b8-a7d6-2f31c5340fe2", "comment": "Malware payload (Mirai)", "value": "077d391ddefa391ef5236132ff27f7a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768660211, "uuid": "63b331bf-2dbe-4ec5-826f-543a4fbadaaa", "comment": "Malware payload (Mirai)", "value": "7291b286d83452441bd4902a47c064cb94885e9bb2ac64ff39c8214108ba76ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768660211, "uuid": "aaea1399-7f2d-49ac-91e9-147a43e1b1cd", "comment": "Malware payload (Mirai)", "value": "025c0aba9973fdf1d27541312c2b9cf8e0c7765f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768660211, "uuid": "207ec409-2e4a-4579-8190-020b62c4b9c1", "comment": "Malware payload (Mirai)", "value": "2d1042ce89d176ce0c4dbeacaaec1aeefa264ee134df378af751694c605d9af26e499802d862f34dd8fa00e37da3701a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768660211, "uuid": "1864ea4a-6835-4e91-ae1b-3e2b27c8432f", "value": "T1F503F106E6D2C103E1EA61360DDBF65B0DA0892DC5ADC18F6AC93430EDF2F366E15B56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768660211, "uuid": "aaca4e69-5064-46aa-8151-d0a182756d8f", "value": "768:uUFw93qRAKujD3cVLlYF2UWvjA9JG0JYraDuCrrnbcuyD7UHQRjB:uUFw9a2KKYYQ7vjA9rCaDuMnouy8Hy9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768660211, "uuid": "7b8ef5ec-e9a1-4437-bf09-98db371df38f", "value": 41160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768660211, "uuid": "fab38d73-38dd-4176-892f-9622d402ade6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768660211, "uuid": "69d00db5-e88c-436f-b1ae-3490964f2173", "value": "ub8ehJSePAfc9FYqZIT6.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d48eaaf8-f389-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768643375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768643375, "uuid": "7a5315f0-bbe2-4c8f-b84e-b8283912a0c1", "comment": "Malware payload", "value": "6142ee1d65a40c2b68c1c3c051bc8bfa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768643375, "uuid": "194b57ae-d08a-4235-915e-7f4f42087911", "comment": "Malware payload", "value": "7707446f34ddad80b4617e6d7956fcacac4884234d8f2cd64ac3ca92bbc84ad4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768643375, "uuid": "2a8a8ed6-a8bd-4afd-b849-cbc6dd98a59d", "comment": "Malware payload", "value": "aea3323697a0a391d49d231f930fdda420a138ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768643375, "uuid": "75f44563-f7ec-4d12-9f17-0c0ee4b010ff", "comment": "Malware payload", "value": "ec1f1ae72af07fe4f1009ff0fb3a926d694cde2a8e98c6dba417b5800166ffc56794db06f63baa06eb3ada2cbfe1a92d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768643375, "uuid": "e8d4792c-87c6-47ca-8263-d61fb454196b", "value": "T1BF473327F18BD43DF86D073B4963A36988F77A66A413BC1797F884A8CE510641E3E607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768643375, "uuid": "f2989802-2f00-48f2-9790-6ef7219e0415", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768643375, "uuid": "17c0168c-97c9-47fd-a742-db82defda941", "value": "393216:fQjFXYADvD8nUUWGAbzqyWDD/Q2opEovjtLcszeUI3nA4btjhWyDeX5n9yU822FB:+RYMOvmqyCzfKbtT6U94bexXF9yU82ZO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768643375, "uuid": "1d3f1f91-fbe4-498f-aeb3-86b5bd8eb845", "value": 25604950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768643375, "uuid": "7e34bace-c1dd-4f68-abb9-3f08a022381a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768643375, "uuid": "b9dfa400-a2c2-4ac4-879b-78766e325c1e", "value": "LetwVqP-x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50890764-f3b8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768663339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768663339, "uuid": "9ae763cc-61a1-4c7e-9256-872956e39a6f", "comment": "Malware payload", "value": "4bd973d03bb145113fe2ff4e7a792b4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768663339, "uuid": "1322b0aa-b057-416f-bea4-2b3b83752dc8", "comment": "Malware payload", "value": "7798f7e551593a46711cd8b35565cfa497b542f17911ff3581b1d9e8bf3edfcf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768663339, "uuid": "97def49e-30f1-40d3-8918-6eafbf218310", "comment": "Malware payload", "value": "13e437e87901dfd95fb2b95b8f95837989e69971", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768663339, "uuid": "67c8b6b1-0468-460e-ac38-893e96c3098e", "comment": "Malware payload", "value": "116480d785fec81e490c275e982f1c3cd38a57757713d07cf66f58527e3c10496131c85535dd0df0641e1c0344eac4b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768663339, "uuid": "2127d927-eb08-441a-a2ca-af501856c842", "value": "T1C6A5C03FF28BA13EE06A1A367972A110553B7A61A4128C5296FCF88CCF355701D3E797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768663339, "uuid": "6dcbf7c6-4471-4334-bd80-63629ad5fff7", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768663339, "uuid": "68c5fbb2-a259-40ee-9b0a-1e8e372b6fa3", "value": "49152:duI5hRUs3WcUUMxuUO6QQNJ8cOxqDNrlHgVN:d5/j3OnuMNucySNrlg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768663339, "uuid": "627c7450-df79-4276-b7ac-42fe0f8720d4", "value": 2097744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768663339, "uuid": "2d2f74cf-8a76-4fcf-b21d-d8a3daa31931", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768663339, "uuid": "fdc2cfa9-9ade-40ea-9106-3dac15747843", "value": "File.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50d3e7e5-f3a7-11f0-a129-42010a9c0007", "comment": "Malware payload (ScarfaceStealer)", "timestamp": 1768656038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768656038, "uuid": "dd70a59e-beb2-481d-8ac1-5760a763972a", "comment": "Malware payload (ScarfaceStealer)", "value": "0b4614c67d467c5e1dd8a065b6f5d3ca", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768656038, "uuid": "bb98a191-a7d7-4a00-8c07-076a1fce309d", "comment": "Malware payload (ScarfaceStealer)", "value": "7899d3522399491450dbc67fc5c0e0e1b825ec93120d2dc14d0673a7195c0faf", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768656038, "uuid": "c560d82a-3bdc-4baf-8b70-3d397d149036", "comment": "Malware payload (ScarfaceStealer)", "value": "619fc8fd871f7545f5cc72bfeab802b0b6a008a3", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768656038, "uuid": "9bf36f50-52fa-427a-b738-c1b3e80acc7c", "comment": "Malware payload (ScarfaceStealer)", "value": "d0e6c0699c2ed2318f98aea82b7696838e8957fcab28adf1e7930ae6af9138ea7c11f47275a7ba4db7ce666405267851", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768656038, "uuid": "81db721b-e317-4de6-b29a-9eee506f175d", "value": "T1805733FEE461D605E9268136CAB559408AB23D319CC30A3B677A7BB531FB3D091E904F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768656038, "uuid": "8c95e9e0-8ec2-4599-a605-bd4baeb631c3", "value": "786432:PRKNkQKZNrFyNR8X/hb/X3QHwPGWggk8:PRMkjrFyNRY/N/QtgF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768656038, "uuid": "dc8ccde5-1280-4271-a69b-8ca3bb98e9a8", "value": 27172864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768656038, "uuid": "3c5dadd6-a046-4226-8ae0-50fec593e39b", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768656038, "uuid": "e7cff3ac-c770-4b4c-a1a5-9bcdf4a0a2d9", "value": "Updater.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d013a3d0-f3b0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768660117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768660117, "uuid": "1ed17c2d-6e2f-46d5-acdf-d6f4fa719684", "comment": "Malware payload", "value": "3d8d39499ea667ffed1bc85683cdac76", "object_relation": "md5", "Tag": [ { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768660117, "uuid": "4b349fbe-3ce5-4e85-a47a-8183be56d4c6", "comment": "Malware payload", "value": "78d7ba162fcae42e2049fd539c981f0fc0dc480598fed50fde2901dd16819df3", "object_relation": "sha256", "Tag": [ { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768660117, "uuid": "a422f131-fe94-42fd-b8fd-171556e8230b", "comment": "Malware payload", "value": "79822b5b62935db643dcff990061375fb692676d", "object_relation": "sha1", "Tag": [ { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768660117, "uuid": "4eb703ba-35f2-4e74-83e1-6dc970446c02", "comment": "Malware payload", "value": "5cd4cfc80f2e9e24ab6a339b92a969d801c91a96ceba521874e8762e4e71c7c17ea0fe875cac78d419225fd912442832", "object_relation": "sha3-384", "Tag": [ { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768660117, "uuid": "2771daad-dac9-41c1-94e7-92dce849f892", "value": "T177873321B2C7C536D47E0177AA29DE2E107DBDA7073100D7B3A8B98A68B28C1577D787", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768660117, "uuid": "7a82e4e0-706a-4eb8-93f3-977204595e5b", "value": "786432:f2AO9JEceD0IosIUgxi9eRbEWSuyQ4/+K03nvE4t:fU9JdY0JU0B/SvQ4/+XXvB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768660117, "uuid": "1e9b6c41-5b5a-4d44-b1ba-68f1d3cab0a0", "value": 36203008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768660117, "uuid": "033effc8-68b6-46d6-8138-4614eadb19b5", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768660117, "uuid": "7e43f01c-d966-4ea5-a3ca-af5353837f2a", "value": "TVGS-9.6n8.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "339288f5-f341-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768612181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612181, "uuid": "aed0b3a2-0369-424d-987d-9a69a39a90a3", "comment": "Malware payload (Mirai)", "value": "0db379399953d4e0dc574809f2eb26e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612181, "uuid": "ef4ae1a8-3de1-4d37-90c3-07c3a7fbcea9", "comment": "Malware payload (Mirai)", "value": "792b28e984a4042630f5c4838588951f8c9006cfaf16d6e0ec02165493bde69e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612181, "uuid": "cd9220ee-19d5-4c84-96db-2d0a5d756ebe", "comment": "Malware payload (Mirai)", "value": "62ffdc3d1cf23bc69d73d5e9bd484afabe47e6b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612181, "uuid": "c3a37ff6-67c5-4b14-8c53-2096417ecd8d", "comment": "Malware payload (Mirai)", "value": "08288f302536554fb2211bebdb6d28b98896358ddf4cdcabb4c67c1722627dae023b6f85f0ee1c17435d8eb9bef3c132", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768612181, "uuid": "32701df2-33d1-4132-9a60-9f7fbb3ab8fa", "value": "T1DFA2D025E346AEF4DFEF9D9493C2C2C276E543C6278AC8E340EEAF013516056B788D49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768612181, "uuid": "aac634f2-e16d-4db7-b500-64d86db3ab1b", "value": "384:9/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5iHM4uVcqgw05VxJ4:9RxsSVsMD6xiJJE5zRWN34uVcqgw09C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768612181, "uuid": "9fbc1c4c-cbae-40ad-8346-d9e038e49dc1", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768612181, "uuid": "52d2cf11-d244-4733-ab4a-6fc154dcd0c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768612181, "uuid": "bcecb072-c762-4bea-9e31-3c01864064aa", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4bb7d75-f3aa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768657521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657521, "uuid": "e6f8f1fd-b8d8-4115-ab71-388570e02fc3", "comment": "Malware payload (Mirai)", "value": "e2ab09009e72ea79292e21df19718820", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657521, "uuid": "a802e1f2-0e2d-4d1e-b0c1-54278b969b30", "comment": "Malware payload (Mirai)", "value": "7a1cc5173def4ba42d8714bbddde20ea595b66bcb8a7945b9977f7b481dedbe9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657521, "uuid": "fabff2c6-10b0-4e69-b785-bb4419756f92", "comment": "Malware payload (Mirai)", "value": "c82c085c051e2e00eea8c1639e1afc795377a617", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657521, "uuid": "79335c1e-1a37-4f4f-b302-ab0a051af3e6", "comment": "Malware payload (Mirai)", "value": "1b70db88c5610839495fb734ced013a552e642c2c24d52dae13f96782c7f12c714a636dd01191869353d89eb11b09177", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657521, "uuid": "659eeea2-6d7f-4ba7-be1c-908629a6dd25", "value": "T16523F118DA0CDA739FF40C706CBFC9837A9D67AE86A8353D65009849B54DA0C52B52FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657521, "uuid": "9261ad3e-5e3b-4d0d-b5a1-67ef8e873315", "value": "1536:+nsKJXoXGfiWaX0rDJ6G1pnJ/gBI15huzI:+nsEfhBR9nYS15AU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768657521, "uuid": "8c9afb87-38d5-4cc7-8f6d-b10b21f4a931", "value": 49352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768657521, "uuid": "e69ed683-7dad-4bec-9410-eb068fa52cde", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657521, "uuid": "e9d0428b-a16f-464b-aeaf-5f6397d7fc40", "value": "ub8ehJSePAfc9FYqZIT6.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66ee9ee8-f3cb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768671537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671537, "uuid": "3589afb0-29ab-4061-8cb5-78614fd8ac2c", "comment": "Malware payload (Mirai)", "value": "02fb38226fa1ed31216c52ec6e6d7407", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671537, "uuid": "f6efb0ab-1a15-44ec-a082-4cc36e16df14", "comment": "Malware payload (Mirai)", "value": "7abb1d7692ec8f1e79f46f916b74650a8925a085f39ce1e16e3e201ec0c63f92", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671537, "uuid": "20924a07-e96c-4c69-b010-acbb4791c2fe", "comment": "Malware payload (Mirai)", "value": "3c89fc3aafe9db6c7e138c2b29583267b1b7e0c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671537, "uuid": "746364ce-00b9-4d94-983c-48dab0f315f6", "comment": "Malware payload (Mirai)", "value": "1bfeb1c86c2861bf044fb05cb3a79983ef586752710e014bc09c09489f22050282ca925422c2f7a381ac1a7eba43f98b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671537, "uuid": "b3b9755a-8e40-4529-b666-21340ea9977f", "value": "T1CAD3C84E6E319F7DFBA8C23447B36B25A759339637E1C685D1ACD6001E3028E241FBA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671537, "uuid": "1b6b0c47-0e06-42d1-a414-868fc7c10ec1", "value": "3072:L2fVP+uRsfGeGfWpX/KDPzj7CCse9H5V/U:6fVGuRsfGeGfWpX/KDPG65V/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768671537, "uuid": "7186882a-5e74-4bcc-ba77-42648caad32d", "value": 130508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768671537, "uuid": "4a484f89-dc99-442b-84d6-b3a8b60b7957", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671537, "uuid": "b6b932e5-0280-46d4-82b9-57d1c7a21b9d", "value": "windy.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "970d590a-f37e-11f0-a129-42010a9c0007", "comment": "Malware payload (RondoDox)", "timestamp": 1768638547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768638547, "uuid": "032aecfc-ba7d-4390-a487-0ab58a35a7e3", "comment": "Malware payload (RondoDox)", "value": "8e79702cf2030a7cf8efbf92191ecb82", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "RondoDox", "colour": "#4E0F4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768638547, "uuid": "c850d6dd-8e97-4db0-a477-251f0ef56d86", "comment": "Malware payload (RondoDox)", "value": "7aeb450c57b466d9a280a02f5bbdb2166d6b092a5a6aa7a440b854cc2af333b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "RondoDox", "colour": "#4E0F4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768638547, "uuid": "7d1392f5-ce0c-465c-83fd-e8ecee40d3e5", "comment": "Malware payload (RondoDox)", "value": "a292891f75e05f1a12df1b93f5430e0f08750c04", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "RondoDox", "colour": "#4E0F4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768638547, "uuid": "5c847495-365f-45cd-a50b-775f7df1af62", "comment": "Malware payload (RondoDox)", "value": "787f33d5398aef58194f4ffcd5085ddac492f1291ba5397e03a1029134ccccb5c6149a912e4350aa4d04fd5baccd1b8d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "RondoDox", "colour": "#4E0F4E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768638547, "uuid": "3daf86a9-eaae-48f7-b10a-af5a78c7194d", "value": "T103C3290AB8C1D5FCD868D2B46B5F6139C860B168113075BA3B94BF563A9CA107F7FAC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768638547, "uuid": "77b68ad9-9959-4093-a3b1-054efc0aa42a", "value": "3072:wTNDWmv0K1nAqc5qCx6Wco/1U1WP1OLy6au/21FFFFFFFFFFFFFFFtFoFFFFFFF4:wpVAHPV9K8YWT1FFFFFFFFFFFFFFFtFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768638547, "uuid": "64db8199-5375-48ef-81b8-e26ee72eccaf", "value": 123608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768638547, "uuid": "ef2110b3-a692-4503-a50d-e4b7196556dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768638547, "uuid": "2f83fe3d-e1ed-4efc-94cd-dce5e1e6bfd6", "value": "rondo.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb53fc2a-f3b5-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1768662311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768662311, "uuid": "d139f174-9056-4d04-a992-0e5ae9fdb918", "comment": "Malware payload (AsyncRAT)", "value": "dab24c381e271f0f12ef7d8e2311650c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768662311, "uuid": "2974a06d-a6c4-453f-bc07-a94cae2f56a5", "comment": "Malware payload (AsyncRAT)", "value": "7fad6f2368bc3cbe17ef7078c9041af857664108f2a7cb13562c6b6edff920bd", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768662311, "uuid": "e67caf65-55f7-464a-a940-f0b37d074a5d", "comment": "Malware payload (AsyncRAT)", "value": "683a65c621ab57b6fcf5c2ed2f204d12c22104db", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768662311, "uuid": "83dab606-64b8-4451-979e-832099e31bdd", "comment": "Malware payload (AsyncRAT)", "value": "d8a72839c5f6fb94a935dbd7ea293985daf7df38cc819b3f6933485a310b0396539d1d623e886be0db3761589af573cf", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768662311, "uuid": "c692af31-a796-41ab-9bcb-8bc5b3d58d09", "value": "T19B647C56DA86CD52C9593F75C63288745273BD7416F2E38EB8C979B32BF33A6000984B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768662311, "uuid": "30e1d380-a2b1-485a-8a2e-a278b4caa373", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768662311, "uuid": "341377b0-0777-4921-a3bd-1c0c61803ebd", "value": "6144:iq2OZluBZUAr1tmsp19NYR7HiO3jMbyVf5WnYChMiEUdIX:iq29Zxr1tmspzUTlVf5WnYCOFxX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768662311, "uuid": "b01fbd37-3106-42f7-899f-2db526157eee", "value": 326144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768662311, "uuid": "727ce939-1fba-4b8e-9c0c-9f823d722514", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768662311, "uuid": "92466fdc-33a1-48b2-8342-38f9cfb94ec1", "value": "Comprobante.de.Pago.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3d352b5-f3ca-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768671344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671344, "uuid": "739de3f0-3e62-4731-b69b-fd7dc5c53cd8", "comment": "Malware payload (Mirai)", "value": "820aa78ff84fa58f0bbbc424036580b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671344, "uuid": "9146b2d3-b001-4482-883b-9c966743a6ab", "comment": "Malware payload (Mirai)", "value": "80116d885ee81a3d9195ce371d0828c579226457ee27b728a18a44e398d0b62b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671344, "uuid": "5ff2b267-faf2-4738-aa90-f20fdd74160a", "comment": "Malware payload (Mirai)", "value": "7c82a82f830ba7fc7ae368019d46a7b30578c209", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671344, "uuid": "013cdbd9-db77-46b9-9b09-581bec38378a", "comment": "Malware payload (Mirai)", "value": "e27bb9b8b715357998f6e22121af7d27a9fb6ba6f86529ce5542a77269cffb8707c6356540f3d9e3e5444fcf75bb2ba4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671344, "uuid": "49ebc8b7-b44c-42f3-9575-392143ab6d99", "value": "T150C2E0706309D268EA72C07E6EEDC3E12B170B28D1CD6452719843A8A5F38615BFA51E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671344, "uuid": "8ea275a3-6c31-4233-96b6-c2c7db77a92a", "value": "384:96YkkHX7udxWrCCLOqRbdINyoWsoIwGrk8GtA+PVh7mfLUWv224585JPifvtHD5Z:cYkUrudxyLPRJE3o/Nsv43dAEs3Uoz9W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768671344, "uuid": "ae368fbc-947c-468a-91d6-07fa3f532c78", "value": 26408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768671344, "uuid": "8098e304-e0cd-4d83-b2d6-b1813b3d9ba2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671344, "uuid": "20868e35-13af-49de-83c8-982d7af30501", "value": "windy.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d5936d3-f3c9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768670636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768670636, "uuid": "8998bc3f-e07e-48a8-9292-d264ceafd4a2", "comment": "Malware payload (Mirai)", "value": "b82ce92034b203f1461f14dff65dc5e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768670636, "uuid": "d9790673-09ff-43a5-9eee-a0f53524de23", "comment": "Malware payload (Mirai)", "value": "8163ea1d05952ad9ebd4def75ddff284c850766d9079dfad245e812ede78b5f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768670636, "uuid": "733378e8-1525-4a15-8907-0d6b28fcde95", "comment": "Malware payload (Mirai)", "value": "90143773f8406c2d505da013cd548130de525130", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768670636, "uuid": "f1ac8f35-b90c-47e1-92b2-5467d08502b5", "comment": "Malware payload (Mirai)", "value": "e32f0a74cff0dada10a230857e019f385de84da091187f33a5f722ac5d645931c9cdfbbeebdc5d40b88287c7e763cbbb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768670636, "uuid": "48c2c33d-e2e4-4858-84d7-9f15356a299f", "value": "T1816318967CC19A12C6E4237BF96E01CD332563A8D2DF321B9D212F5477CA82F0D67652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768670636, "uuid": "019360dc-81f6-44b3-9487-ea71ff8474e0", "value": "1536:161Uv/15au1m7+tIVp5fm5tyWpRT0fN6cahWMUiU4g5X9/e35GZjO:16+tRRYN6vhT9gi3Gj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768670636, "uuid": "ba307be3-f37a-43d8-b129-fcde2808fd82", "value": 72168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768670636, "uuid": "e91d1d2c-1d8f-458f-aa89-2e3a083b524a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768670636, "uuid": "fafb3732-37bd-40dc-a118-024013eb3071", "value": "vcimanagement.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "174edec1-f3a9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768656801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768656801, "uuid": "06e65c05-cc28-4080-8801-2ce13397e3d3", "comment": "Malware payload (Mirai)", "value": "6f2ab3ef46434c81e760d5b60bece72c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768656801, "uuid": "a4f59b4e-3b25-41a9-8ee9-d94fed34e9c3", "comment": "Malware payload (Mirai)", "value": "82e058e37eff147a65c548d3637d907c14d3da6c4282b0559af3281809b32988", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768656801, "uuid": "95b288b1-9e02-4a46-9186-fbeebd3e302c", "comment": "Malware payload (Mirai)", "value": "3464b5ddcc9f2538a38a185145d21ccbe11ea86a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768656801, "uuid": "7a9aa7fe-2cda-47fb-ad1a-678952e7ebe3", "comment": "Malware payload (Mirai)", "value": "6c91827e8d318b13e4c5f9e2527f5f41030c6f2c1606335ac23166114209457f69418d10dc67eaa170c1be5511053378", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768656801, "uuid": "4f8eba5b-6a07-4a74-bb10-de4f92daa927", "value": "T1C733F2CCA98CEDD6C9CC4F3567FB0634698EA558583F0F35A36ADC88EA76050AD4C4E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768656801, "uuid": "5d5f3676-6230-4f27-9b09-68905a7c46b8", "value": "768:vYD/fkV+MIxAwooxO2u+/QcMqBJk5GWBTZkvSGPwlqLiXYwEu+5ywfmW0:QC+Mp2x3/QAe5GeevDolq68Yt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768656801, "uuid": "b3ffbf94-f4f8-4cd4-a9d3-d0c35890786d", "value": 54796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768656801, "uuid": "19f5c30e-fc52-4032-8c85-cd0c9cdd09a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768656801, "uuid": "8e7cca21-e357-4a86-b5f8-fe2e004d81d0", "value": "ub8ehJSePAfc9FYqZIT6.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe4d74c2-f3ca-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768671362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671362, "uuid": "7bbfb5b9-c686-499d-a362-5b68ccbfae66", "comment": "Malware payload (Mirai)", "value": "f29315127d6e5733f7ad4ff47966648b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671362, "uuid": "0f8a478b-3923-453d-9f81-3ba681048a4d", "comment": "Malware payload (Mirai)", "value": "8388d1a320874a8399e134f8304966a369a7322c590adbcadb4f90a24c32fb41", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671362, "uuid": "de53aa03-d3da-4783-b0ba-2e7a76e4d92d", "comment": "Malware payload (Mirai)", "value": "e6ab34e940d4d3d9ca2c3abd8a47c0d3331882c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671362, "uuid": "fbbec3e1-aa56-4e03-9692-d75db6c3e88f", "comment": "Malware payload (Mirai)", "value": "b8f4d199150e67ff85e04a01db97e61b90cb95fd6f77524d67f7d788a64f4ca9ede119c06742575c4b535ce37f3eeb99", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671362, "uuid": "4bf2018d-52d8-4cdc-bc99-6535d3a82e1d", "value": "T11FD3ADD7F34B24A1C82246F007C77F9E2E637102DEEBA5E76D0E663B19791DA1806391", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671362, "uuid": "447a68d2-29b5-49b1-b3b7-14b50c6afbbc", "value": "1536:FvvTrsnoj5Jc8Z6LM4FDVyL89L0DaeIY3sbelR0C0CrxOsGiOxgDh/LWj:FvvT8KLZ2gL8WNJ3sbecC0Ct0gDhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768671362, "uuid": "e4047e70-16d3-4505-b41e-b87979d92230", "value": 132548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768671362, "uuid": "2f615343-b7e8-4be4-bfa3-fa10a89a3ce3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671362, "uuid": "b07d7ac4-dbca-44f7-8937-6b80d39666d9", "value": "windy.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1c52696-f3a9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768657033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657033, "uuid": "0c5795e1-518a-4cff-82b7-1bce2eac1c46", "comment": "Malware payload", "value": "b306f0becf6c0a06d90936918849dece", "object_relation": "md5", "Tag": [ { "name": "212-34-136-81", "colour": "#0DC925", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657033, "uuid": "dc31f474-3fbe-488b-a35f-0a6ad7b3fb45", "comment": "Malware payload", "value": "83f3c1a8933fd3ce393e8a3c0b30b2d5ae12f38df4ca84e560d1d768a886c9c1", "object_relation": "sha256", "Tag": [ { "name": "212-34-136-81", "colour": "#0DC925", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657033, "uuid": "c7eb92e6-b9f4-427c-a8b1-3c9177ac3031", "comment": "Malware payload", "value": "f6f9022f52c41cf8951fe54158823a06e5d8c7b9", "object_relation": "sha1", "Tag": [ { "name": "212-34-136-81", "colour": "#0DC925", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657033, "uuid": "e30dd1bc-bcdb-4ec0-a3ec-9e4fde78338a", "comment": "Malware payload", "value": "b1dc52e906c3ccffd55312080ab7747db79cf439b7887fcaf28214d0d905f36b5b0728d0507d836a038f43cf7a57ad8d", "object_relation": "sha3-384", "Tag": [ { "name": "212-34-136-81", "colour": "#0DC925", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657033, "uuid": "edbf9618-126f-4bf9-b16f-f58ac170c506", "value": "T1EE1733529A61FDD7F63A763C1828950CDC9AF428D1988C426F840AFD1DCBBDE27BB111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657033, "uuid": "069694e8-d1be-4175-8265-a297aab9a735", "value": "393216://ckWX/L4Kf8b5M5EnTt44OcRGmYfPTLgT59+Fj4Vx2:3ck6sKfScEESafoT5aj4Vx2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768657033, "uuid": "0774e5db-494a-4538-b60b-fd7cad22e776", "value": 19855669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768657033, "uuid": "2b7b0351-1021-424f-bd8f-01e125cb5d8c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657033, "uuid": "6c9e497c-cf70-42c5-80a4-eed260a01f72", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c59cce4e-f3aa-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768657523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657523, "uuid": "5654c074-79e2-4fee-86b4-6dc10cafc4de", "comment": "Malware payload", "value": "65d58dd2a05073adacde66f74b57b5b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657523, "uuid": "f5724b26-2a5b-469c-91b5-2f072402bc6c", "comment": "Malware payload", "value": "848464e44045c74124c228af6b76665adc8c8ea3994e2b70045a95db862bba21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657523, "uuid": "1c43c544-ac3b-4f13-8092-44ffebf48d9a", "comment": "Malware payload", "value": "0daedb2e27e0007185aef8c6e5fa171a86ca7245", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657523, "uuid": "e153a242-f0e2-4b21-8de2-a1f68b298b1e", "comment": "Malware payload", "value": "4a39b54100e7bb8bbf6de98a01beb34ec50eaabd3a4b74c681c2961b1fde01512117bbc9cc46eab533f2d8880bdece74", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657523, "uuid": "a7eda16d-ba29-4b0c-9f12-e411fa577b15", "value": "T17E94D002F3113AA7E10A85365441870467C4AE7533E2E302EF97B2B9756F1B5CF287AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657523, "uuid": "0f1eb532-c358-4fb1-95ec-5833875fa7c7", "value": "12288:t4ewYUwIWvSwd0JeF+nHdFe4q/rzW6SyIiDTz8SA:NwOv/eEF+M61inwSA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768657523, "uuid": "eb3fdd62-ab86-429e-b9c9-4f70499f867d", "value": 448760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768657523, "uuid": "3533aae3-aa39-44d9-afaa-23ebd44fa623", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657523, "uuid": "c31fd667-9850-42f1-9ca5-eb3bc7df0ddc", "value": "rondo.armebhf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "401b347e-f3d1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768674049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768674049, "uuid": "2451196f-b855-4db6-883b-781c5c2015ad", "comment": "Malware payload (Mirai)", "value": "761b68d28d000d2764abac64fbcf22e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768674049, "uuid": "a817b49d-8e84-499a-9e29-ab8d8c6252ea", "comment": "Malware payload (Mirai)", "value": "86b28d6ac785d84beef581e59c9f67f96d0e6787af5c24a8a06dfacdf095e846", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768674049, "uuid": "30cd9f49-360d-42c7-bbf2-28ce2bc237e2", "comment": "Malware payload (Mirai)", "value": "cf16a8b3ab2255a0bbeb3beb75cba791cf1dd29b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768674049, "uuid": "730b5eea-3e3b-4d7e-9e5c-85edc5047fa1", "comment": "Malware payload (Mirai)", "value": "4b951695aeebceb961853af13cb9bd81dc225c94e130351b94a5263f60f95a6e1430978c1db359b9ed9df09f91014b02", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768674049, "uuid": "7fe99a8a-6507-4e42-ba18-3f01c2593e09", "value": "T127A3E70ABF650FFBDC6FCD3706A9170525CC691A22F57B7A3634C918B50B60B4AE3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768674049, "uuid": "7ecc3337-c587-4648-9167-290a20c85c46", "value": "3072:bNZn69fRZscOdhkMvhyiC2tzNv6ZG7iyGiB1g:bax96FNvcyPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768674049, "uuid": "d00829a1-e982-48c8-b945-efd47e1ccebd", "value": 101560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768674049, "uuid": "3e447d9a-ba8a-43b7-891d-b1589bbda29b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768674049, "uuid": "634531b4-6bd9-4e56-9737-9645f025787c", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebfd766b-f34d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768617644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768617644, "uuid": "c6414b64-cab1-4eca-b7df-edfa3a013f3e", "comment": "Malware payload", "value": "05551c46961aad00d35a79ce01bc7908", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768617644, "uuid": "7664899f-1aa1-4720-98b1-de5da39f4a12", "comment": "Malware payload", "value": "86cf13cfb953cbfb8d1167f259928bb200a9e953ba8a45d5d71e9252f05ba009", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768617644, "uuid": "bee435f1-b4f3-4c5e-b420-2a8f7bc22dea", "comment": "Malware payload", "value": "4cb98f0e12dabdfab95cbb20a09d33738b47b8de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768617644, "uuid": "2332724d-6be4-41f0-ba19-99ad97616068", "comment": "Malware payload", "value": "b4834edc30e86e145b70d0cbb337c5929c5aa97549e736e9037ab85c0374c758edc934e35329fcad4199c7eb5c3911d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768617644, "uuid": "b7f6fd78-ceb3-45fc-a90e-b7d2c98e8e85", "value": "T17AF3619D766072DFC85BC876CEA81D64EA60747B531B9203A01316EDEE0D99BCF190F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768617644, "uuid": "2fa66a61-9ca7-46dc-8d60-933b717ec64b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768617644, "uuid": "cc3233ff-a663-40db-9e58-0b61c2af8164", "value": "3072:rzLpVCttgBi/st8RbpvUC9iPsNw7Jx1d4hI7y3q7J+i0oFBt:rztVAZG8hpvUCsUyJxgI7y3q7J+i0oFB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768617644, "uuid": "4d21e975-bc3d-489b-a8e2-b21854757aac", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768617644, "uuid": "8f914473-df65-4ba9-a6a1-25ac9dbd4b92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768617644, "uuid": "bb41ce2f-925b-4999-8ce1-33845a659c96", "value": "vlchrome_update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75c4714c-f3ca-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768671133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671133, "uuid": "9f387034-db79-4914-a04a-7b508cbac70c", "comment": "Malware payload (Mirai)", "value": "575e42da78a0ce0b33d5b341a0f7451a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671133, "uuid": "fc463c36-92b1-4bbe-bb25-3fb07d195c6e", "comment": "Malware payload (Mirai)", "value": "89df59fb0d46e5aad4afd33c7cdef00437fbaa9825af8b185d7333ff890d1179", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671133, "uuid": "f5cf8acd-b1d2-48a8-bb5c-dfc26c028727", "comment": "Malware payload (Mirai)", "value": "22778c2bab8faf641de1bc2330d901924e0418dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671133, "uuid": "fefcfafb-9be5-4485-aa0c-e897883919b6", "comment": "Malware payload (Mirai)", "value": "8fba124771bb05aa13e746cbc44f4d0950ab28546d7fcaf1228fafcad1d973e0795542ea44f3e3dbd3f381e4f4e804ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671133, "uuid": "d4c392b1-d640-4fa7-8ba4-98b611f3a356", "value": "T109837DC5EAC3C8F5ED2209351272BB275AB2D13E2268EA83C3A5D975EC135C0F156B5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671133, "uuid": "c133cc00-da6b-4723-9337-5c6af615c5a8", "value": "1536:BWOLMM5Md2roKBryTyX3tAjw19KHVdxYQ5bBH:fLxMdebrAynti+9IYQNBH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768671133, "uuid": "089ea38c-4aa5-4d0a-abd3-dca51bf645bb", "value": 87316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768671133, "uuid": "bf88131f-806f-4499-aacc-a70cd0f8119c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671133, "uuid": "14ffac89-1e61-4629-86f0-881158f58e76", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65aa6ccc-f3cb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768671535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671535, "uuid": "5c589e5d-5506-4509-835d-620c0a9f3cb4", "comment": "Malware payload (Mirai)", "value": "c2be321d227621836b8d2d9c78cacacd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671535, "uuid": "352d65d6-cd54-4e96-9a94-c2ea003ddde4", "comment": "Malware payload (Mirai)", "value": "8b31ad4f636eb80636ab9d47341d665662d3aba23c06b1b5f7eb090a0d0ae627", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671535, "uuid": "afff9876-2f98-433d-a1d4-703ab1741920", "comment": "Malware payload (Mirai)", "value": "78352e66829eed3fe21bcd7f764946ec16d553eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671535, "uuid": "66ecf848-c4bc-4c0b-b464-51d8e75053e3", "comment": "Malware payload (Mirai)", "value": "a619c9060b5a25fe808a1a018ce8950382850e87e14d17dc8527789bc7ce094781ef4e5c1e4143328a044468550ead23", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671535, "uuid": "192a3b68-4b52-4da2-a077-29dc9d176cc7", "value": "T171937CC8EAC3D4F5E82605712177BB3B5AB3F57E20E8DA43C368AA32AD125C1D40675D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671535, "uuid": "6e48ec51-cd77-45d4-8287-2032f3418141", "value": "1536:Z3DHlTib5DaUZP1bGh5kLpfDomk+lGolli5nGlM/9d0q8Z74:BDswUZ45kLpomzltK5869d8Z74", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768671535, "uuid": "d04998f7-c3ae-4c07-b1ff-52c797503de0", "value": 91440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768671535, "uuid": "e4954a69-eeb6-459b-8194-db397f87f26c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671535, "uuid": "6c4c10a2-e689-4c80-afad-b3a7dc77e8d1", "value": "windy.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "792483c5-f3ca-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768671138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671138, "uuid": "e31150bc-2595-4fa0-83d4-712c61a9bd24", "comment": "Malware payload (Mirai)", "value": "75eeb573562331e4c8812d251c37312c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671138, "uuid": "31afb192-120f-4e03-ae1e-1c47f8dfb8c7", "comment": "Malware payload (Mirai)", "value": "8b964204fec858a7a4ce20c36a969d9e167203ab23f19ee3213c4914104c3331", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671138, "uuid": "66628e8e-8d7e-422f-bb48-24da05a5a775", "comment": "Malware payload (Mirai)", "value": "ef7afb5b063f7de4d4caed2570689890522d674e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671138, "uuid": "fba04d3e-717e-49b0-afd0-abf93a82c252", "comment": "Malware payload (Mirai)", "value": "786c7cb4cdfc432cad2a8bf925dfd53cbea5b191f28f973404b3f2ffa16f424c1c032a9efec5ab37fbe2e0451ea08728", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671138, "uuid": "2122f7c1-0ab0-4523-956e-340d3bed021a", "value": "T19A73AE23C8AA1998D25C42B8B070FE3A5763E45056536FF7059BCA7AA047EDCF8093F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671138, "uuid": "b49d91a9-b89f-4fa0-8199-503079e69054", "value": "1536:U/G/lVA7lvz4CXKLKIJjL74QN/VQC9yUxdM7A:Ue9VUx4CXKuI1J/VQ9OS7A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768671138, "uuid": "ca66a5e9-e042-48f7-b0b7-3b171f82324c", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768671138, "uuid": "93e4d9c9-a068-4da8-b960-a6b1354d6425", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671138, "uuid": "196c53ee-378f-4b8e-ba3a-81f872f559f2", "value": "windy.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa3a9bdb-f3e0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768680670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768680670, "uuid": "12e6b812-b4f2-434f-9f09-fea3f4ae2b8f", "comment": "Malware payload (Mirai)", "value": "fbe487594f4f0e33b59d4fb664af0231", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768680670, "uuid": "6f6f4bf2-dae2-4ee1-aba2-4358384c5d4d", "comment": "Malware payload (Mirai)", "value": "8f0c8ed285e0e92de8f3e473d83dc3be7a7ffafcd4bce49a706f0a7cea1146bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768680670, "uuid": "c6c770d3-4006-4bf7-bec0-24b8c7d24383", "comment": "Malware payload (Mirai)", "value": "d30af5deb43fe19c461be326f206e9ec8780761d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768680670, "uuid": "72603f8f-5ffb-4026-9b78-c08478539e78", "comment": "Malware payload (Mirai)", "value": "6fe89ac554511cd821c077e22fb743f945baee2f5ab12dc89da79802197fb3e3c3e45edcb21ad77578aea63a4c06207f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768680670, "uuid": "ebee43c9-d701-42e8-908c-c2bf16afe7f3", "value": "T1429319C6B401DC7EF80FDABB4463690EB631E26116835B266757FD93AC321E05927F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768680670, "uuid": "137529d3-a1d7-4c56-8802-157d26462c0b", "value": "1536:spsdLEbXJld3Z6s6RRYjGTvj2c/HcEFWuWVFPn8bY7mNgv5O68Y0zTnVpiN6O994:ej6PRAGTvj9wuWVdPS+OdYqe6O9/C6A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768680670, "uuid": "fce27ebe-4739-4d4d-a399-b09ab43b31d9", "value": 96744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768680670, "uuid": "339da55b-6401-4f70-81ad-f0ec0b81135d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768680670, "uuid": "c276d8a3-6bac-4c9f-8006-d8f0b0967cba", "value": "windy.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "046daefd-f3a6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768655481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768655481, "uuid": "487e692d-01b1-4f12-9d41-83ba85f1ae6d", "comment": "Malware payload (Mirai)", "value": "bd08cfcc479fe19e4c9744439b18f3c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768655481, "uuid": "d738c7ce-41ad-44f2-9727-70d9e9bfdf4e", "comment": "Malware payload (Mirai)", "value": "906154fc027fbe894dbd48fb3452e13eec09a3d4db1abe0a03c5d7ac52cc01f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768655481, "uuid": "f792bab8-ea2f-4555-8cc7-81ad8e8503d1", "comment": "Malware payload (Mirai)", "value": "c01ab4effd9278bf0fe37b41a2b11937bbc0bbfc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768655481, "uuid": "3a7ecef3-3ee5-4c46-a6cb-ecc0e4f5cdd1", "comment": "Malware payload (Mirai)", "value": "cb71ccf53d9b3dc3305566523eecfcf21d22ba4ac679adab02f88cb7f406ff4cea3c2ada6cefd262fead6250c9238b76", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768655481, "uuid": "a187bc20-a145-43dc-8bc7-beece215c9ae", "value": "T10903299BB492886FC5D8437ABB7E121E7311F398E1CA7707DE5C8B15368B20A9C5F940", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768655481, "uuid": "2e81a4ee-1685-46c0-b18d-ef8b758ee0e2", "value": "768:AEYHaGj/DMheFLq2DVZJ1soUSEkERZoS:AfgmLdJ1sohEk2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768655481, "uuid": "e9e361f8-7dd0-407b-af96-b6910dee728a", "value": 38204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768655481, "uuid": "0e790269-1fa5-4496-aca0-30c31772b31c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768655481, "uuid": "f67463c8-0f33-40b3-8265-d537c6d2f673", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39bd6ce9-f341-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768612191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612191, "uuid": "017226a4-475f-429d-879d-eec3ac34dcb4", "comment": "Malware payload (Mirai)", "value": "b9c2a0e8f6400bcc311a6a1cd253a677", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612191, "uuid": "386b0b7e-b08a-4d83-ac74-616faae76952", "comment": "Malware payload (Mirai)", "value": "9785b6689d3e35d11dcb00474a991e3a3e4c074cd6ff9b681a8c91f723e9fabf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612191, "uuid": "126bd46e-72f5-481f-ae09-4b915f30446b", "comment": "Malware payload (Mirai)", "value": "fa319fddba267ad85aea85d64096513946e4dc7b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612191, "uuid": "a97fcc28-b24c-419c-b884-f8e1d4cbc40f", "comment": "Malware payload (Mirai)", "value": "205a28ea2467b066a6e47aa89883edb524a1557612764d6e25fe53151e3a1a450a69e17946d32b583834965cdb1f43c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768612191, "uuid": "011ca5ba-b95f-47e0-8714-ad7ca7bdc463", "value": "T12A82CF3061AB75E5CBF10430EAEECFC697160BF9D1FC36A31A586B78894210655F92CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768612191, "uuid": "f14b360c-7fe1-4482-b6a0-7911c803e25c", "value": "384:MjWzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMaQhymdGUop5h5ly3:6GV0P6+kom0tVAoNvm+to1Qs3Uoznly", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768612191, "uuid": "be892e05-718b-4a05-9311-5cd23499d641", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768612191, "uuid": "c81060dc-7e7c-417a-bf69-ea38e8519afc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768612191, "uuid": "66f0da09-1179-4ee2-a001-962f99b8c842", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "138266f5-f3de-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768679558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768679558, "uuid": "9423ade8-f47a-4766-a4d9-c3eb3bf472ac", "comment": "Malware payload (Mirai)", "value": "154aacb307a1673ef30779c675dfb7cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768679558, "uuid": "03064cbc-6b76-4ac7-9d7a-eb415f1e6981", "comment": "Malware payload (Mirai)", "value": "9866b68c4bd4d18fe6c492de11c77fb3092468966e7fd2f2dfca91d49da4fb58", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768679558, "uuid": "953de692-5086-4fcf-9e72-f926d796cf54", "comment": "Malware payload (Mirai)", "value": "5f1f3ab130b5cd83546a4748b996ac1372d19329", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768679558, "uuid": "7a3a1117-fda4-4273-9325-40ae4dc283d5", "comment": "Malware payload (Mirai)", "value": "a26e0e19564e4d807a63c1cd14ba295ed33fd893190453a735afdf95029d6bebf8619c6b9ac6c91d9e0ac558e8491b01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768679558, "uuid": "9c44b6a0-0a55-4936-9693-325045c1dbb5", "value": "T1048329C1FA8BC0F1D91B88304067F63FCB32E9695061D75DEF9A9E35DA33581A216389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768679558, "uuid": "77cf0a2d-4c28-4dde-81d9-de1c2b8142e8", "value": "1536:iFDwDhVtcU4xiUWaqH3FxiSewYW16eXKjfTsv4gz9F7vT:+DWKzQLH3FwSjMeXKjfTc4gT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768679558, "uuid": "2b1c1620-7b83-4948-adf2-c02cd0f40a80", "value": 87316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768679558, "uuid": "555903be-1c0e-4a56-96b9-36a4dbdad6b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768679558, "uuid": "c87f6760-9731-412b-9340-ac49bf73369a", "value": "windy.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3c7797e-f3ab-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768657976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657976, "uuid": "76133676-5104-498d-8e0a-c23ae52fc171", "comment": "Malware payload (Mirai)", "value": "0ea5ad86e3ba67ecaa59767c6f15778a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657976, "uuid": "1f3ff469-d4e1-42d8-be0b-9f1851e428ac", "comment": "Malware payload (Mirai)", "value": "990aacd85ac89f31ccc4c0656c4e704d44878556458532fb2a7a15e71beee005", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657976, "uuid": "9e86265e-f9e7-409f-a0d0-76bb49f16ace", "comment": "Malware payload (Mirai)", "value": "0380a0149f41e26499bb1597aaf9d151aa3d7995", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657976, "uuid": "04b8b773-a359-4c3e-b14b-3b6a114f09c6", "comment": "Malware payload (Mirai)", "value": "d58dfe312ed299fa6f1f2051cc8adae3dc25639726d3589a24f1a5071089bc57cee92ae9eb3f03bd65a4e798757e645c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657976, "uuid": "8213cb94-477e-4515-bf6d-1ec7832e54f6", "value": "T1EE04855D6E228F7EFAB8827447B34E21975923DA23E1D6C4D1ACD2001F6025E641FBF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657976, "uuid": "0b963973-33dc-4bd8-a9cc-bdcffaf0b07d", "value": "3072:L5rsaS9/98W+4TL9lw/UmVcNpnnPGCvmUNLS7C1Ix3mVYeaO2k:Vrtuf9lw/UmVcNpNvp07uIxsY5O2k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768657976, "uuid": "d84b098c-5a77-4800-8c1b-86f9bdf87719", "value": 178424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768657976, "uuid": "34d08a9f-6ad4-4585-aa7e-fadfa59f3cf9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657976, "uuid": "4402c8e6-7669-42a6-8c11-467987244a70", "value": "ub8ehJSePAfc9FYqZIT6.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b4dbe80-f36a-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1768629857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768629857, "uuid": "464db5fa-f312-415f-a807-46284105ee67", "comment": "Malware payload (Formbook)", "value": "1565669fffcdb8792a2bd603637fbc03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768629857, "uuid": "427f88f5-135e-4d86-a517-228aeee79873", "comment": "Malware payload (Formbook)", "value": "99e787914a65e928c023070c9a029cf58d4e405e4952bbb1142b1c8e53edfcc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768629857, "uuid": "e27fca38-0c81-481e-8e71-fe1a4f6acfb4", "comment": "Malware payload (Formbook)", "value": "775c9c9f0f462f056a3c4883a03782bcec5c79c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768629857, "uuid": "adb72d80-67b6-4f3e-b1f7-63e140b7c8c2", "comment": "Malware payload (Formbook)", "value": "301381466c5ea61bb88d4cbae86845300f8857b53bb0e4b696b7241543be808630b44788326c52062a1c58bc9fcdac97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768629857, "uuid": "041a043f-8092-41ba-b526-83d1aebaf996", "value": "T12935F1582709D103CA6597B81EB1F2B8076C6EAAB510E3175FDDBEEBB876F064D40183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768629857, "uuid": "9f86a233-7bf6-47ee-94f6-b7b17db2aef2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768629857, "uuid": "93a92363-934c-48c4-9510-f33f775fd955", "value": "24576:efs9Ce5nasrW3ei/ffS82VMTU+UtxCPrc7vts:2sQWasrWdx2VMwnDo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768629857, "uuid": "12d62fb7-62f3-4d63-88b9-74534e0a96dc", "value": 1096192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768629857, "uuid": "79338ec4-0f2d-4bd7-84f5-e146038a2fee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768629857, "uuid": "90d61729-5ba2-471a-a820-b61beb664b05", "value": "VesselSpecificationDetailspdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "750f9e4f-f3ca-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768671132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671132, "uuid": "5f4a4138-ee05-40c2-99d6-19754ba495d9", "comment": "Malware payload (Mirai)", "value": "1feb4252057f1bcdf03a813ed59b6470", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671132, "uuid": "92a78396-43d8-4989-bff3-239ee9f17df5", "comment": "Malware payload (Mirai)", "value": "99e89e27dea4cba82ff9e614289d32919e8585d55f836f00277eda15b209d47f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671132, "uuid": "667826f4-9e68-4dbd-a7b6-c25c69a29bea", "comment": "Malware payload (Mirai)", "value": "1934ec21b2b3b0508a6dd78e6ecb161c48eb34aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671132, "uuid": "c041482a-5d61-448f-95fd-6516c399c645", "comment": "Malware payload (Mirai)", "value": "29187f266602f21cd98b38052dc67f71edf22468b7ddb437d3ffb3553e83e935a32157a49425662d8b53be9596a2e0f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671132, "uuid": "52ace055-8045-4b17-89aa-fc1a27888486", "value": "T1D7834A47B981D0FEC499D03847BF7137D923B4BE1239B29B63D4AE266D09EE01B19742", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671132, "uuid": "a56b73f6-7b6a-4ac5-8f56-6373bd577c05", "value": "1536:9q87I0gcJgJ3DaQXazQCE0FRedzU0Nb6WLxkU+p/:r7pgcJgJzaQKzQCnRetb6WL0p/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768671132, "uuid": "0811781e-6562-48ab-b02a-fd6b1d8e4dc7", "value": 85936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768671132, "uuid": "3cde663b-963c-4cdf-bec7-d5adfc7744d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671132, "uuid": "ef33dadb-3559-4dd1-992a-946014e802a1", "value": "windy.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7a200e5-f3e3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768681954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768681954, "uuid": "18a49bb0-034d-4d59-906c-d9af94e26195", "comment": "Malware payload (Mirai)", "value": "891edbddafb093883872fe729ab24da7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768681954, "uuid": "36e7b464-0346-4405-a3f8-db434f35cc0f", "comment": "Malware payload (Mirai)", "value": "9ad3a1c947bef2d67ab1d659ee391b47b4655af952a214fc2d5ad8a6c16ad58f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768681954, "uuid": "934ef5d8-6d6b-4384-99d5-27c46724fb6f", "comment": "Malware payload (Mirai)", "value": "2e7b65b82eb940d8dc61ba53cf61800bfb65ed58", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768681954, "uuid": "78ff2bbd-33ec-4a17-ba28-cfae62c9a350", "comment": "Malware payload (Mirai)", "value": "80a30dd136934bf66516cd32761cb4ad4670f146eba937c5730df4760f64171fb55f86138218f37c80321c07417df4a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768681954, "uuid": "9d254e4f-24e9-4a91-a5d4-23ef199a56b2", "value": "T17504BF63B30F2091C86246F80BCF6B5D262365025E6B9BE77C6E363F5A361D949063E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768681954, "uuid": "873ccbe1-26c6-4ae1-9b60-737aae7d55ab", "value": "3072:4JRZhScDUwTmvJmCOVwxUIpLFxrvejSJIoAJg7CgwuVnGQ+Yq:4qcwvdppTrvIWhAECgZVgYq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768681954, "uuid": "e39ad159-3925-45ee-aaf7-c568ca45a567", "value": 173696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768681954, "uuid": "b4aa4b8c-6515-4125-9289-e45c90a5a486", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768681954, "uuid": "4f793a71-2f2f-4266-abbb-839031644abe", "value": "Polar.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b3292fd-f374-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768634125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768634125, "uuid": "cfc49ec0-e979-46f6-8656-2964c48e59c1", "comment": "Malware payload (Mirai)", "value": "ec60ea3f478d1edda8252e71c6f9224e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768634125, "uuid": "c5f21e1c-bbf0-4b86-bfcc-9c4d698325b2", "comment": "Malware payload (Mirai)", "value": "9affdd7320dda529271f43090f8b8c3e82963d382e21a73d00cde6068090252f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768634125, "uuid": "65383eaf-03d9-4415-8d90-ded08d610897", "comment": "Malware payload (Mirai)", "value": "109b9da75310f9e2a13df4f6befb1ed7f1d54f6b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768634125, "uuid": "3ed030f2-a119-4947-925c-b506ccfab291", "comment": "Malware payload (Mirai)", "value": "d505b15411a1d34e3f0e8d089e333501efacda65e95cbe3df0e24f5c2bf31a514416a31b8e6121b520a99e5d36c84d41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768634125, "uuid": "03b522c3-eb8f-4d8e-ab9f-4e2c2c777024", "value": "T145C3196AFD81C552CAD31677BA1E929D371713E8D3EF32078E294F61279782B0A7B101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768634125, "uuid": "8ab5852d-bee3-4e2e-8dd5-c99a37b52237", "value": "3072:Tvi6pu1SnlmlOll0lNl4lsl9lO2l+rlpDlPljlJQl9lVlIGlwlalrlGl3lClBlYq:Tvi6pu1SnoQlaj2eHw2Ur7DlBbQP3GGd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768634125, "uuid": "0a32798b-8558-4e60-9532-f990c6128189", "value": 126432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768634125, "uuid": "3829fea6-94fd-46d9-893d-111e5f1154b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768634125, "uuid": "6137c24a-154c-496a-81fa-13386766c403", "value": "rondo.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d74c1d3b-f3e8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768684181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768684181, "uuid": "f3ba3b49-5bb7-4648-a7ae-f879688a2b58", "comment": "Malware payload (Mirai)", "value": "c8f712aa5c1cf9e4926685dd1b304436", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768684181, "uuid": "690fb9e6-34d5-40b5-9320-907610190727", "comment": "Malware payload (Mirai)", "value": "9be6e18f2c32b7df31478dbef3d2b98471ff0eb48921408812ffb9940ec4a52f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768684181, "uuid": "53cb098e-24ec-4022-9faa-619f938da304", "comment": "Malware payload (Mirai)", "value": "648d00b4800553cc8b73c134877e6f6484bf77bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768684181, "uuid": "942f60e2-82cb-45e3-9122-bdd75b88a0cc", "comment": "Malware payload (Mirai)", "value": "08381e302f64b70f1aba15b8d2237e91c7abfade202686b3d40b00e390eac0c2824fb9921a11d99efa3f79bbeec1bf8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768684181, "uuid": "e41b17c8-1b10-4a49-96aa-05d49809365e", "value": "T138041946FCD18E16C6C612BFFB5E418D372657A8D2EA31039D266F20378B46B0F3A645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768684181, "uuid": "2635c87e-daab-4ab7-9977-c74cc2d86cda", "value": "3072:RSCz59xliAZ6tlL/CH6+CiBkx4JQccbQApc0XUS:gCz59xliAZA/CT3mx4mcKQAS0XUS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768684181, "uuid": "16ce94ff-9831-4830-b565-9b991e6e05b6", "value": 175424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768684181, "uuid": "d86a031f-09d1-4ad2-ad27-01cd3053876c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768684181, "uuid": "abb96b75-c5af-44c6-bd60-e1a810c15ec2", "value": "Polar.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b60af6c-f3ca-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768671142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671142, "uuid": "d25ebf23-e5aa-4cc2-a7d5-a96f4b5782c1", "comment": "Malware payload (Mirai)", "value": "7fc69cc2c34c4f5b9f9fd344afba80d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671142, "uuid": "6abd99af-c17c-4850-a3a9-bb4fb5e941c2", "comment": "Malware payload (Mirai)", "value": "9c861b7feb72ab09ea718934b32eecab230a0e5c58a339abec3b0b46d4eb99e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671142, "uuid": "f048d4d9-3e9c-4971-b416-291eee83b6dd", "comment": "Malware payload (Mirai)", "value": "11347ef683e15f5eeaf85da304d6b216fb8fd9a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671142, "uuid": "95aa04ee-e5e9-48c1-af55-7195d09566e5", "comment": "Malware payload (Mirai)", "value": "38ef9ba63fc995b188abc12c2559e372834a04f47657e7bf4103b59e85322e4738ee2db4df2403587c963918f1382b4c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671142, "uuid": "869dfcd1-f4ba-424d-a2d9-c6b71f09e11f", "value": "T111044C46EB814A13C0D62779F69F524633239BA4D3DB33069918AFB43F867DE0E67601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671142, "uuid": "1f496dd4-8574-43fd-bb10-7d8a9b060657", "value": "3072:Hlco92mDLaepNPR9ZpO45+EPCC6uUVdHy3d0fM/9JDT8hM:HlCiLaepNPR9jOARCzusdHy3dEM/9GM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768671142, "uuid": "002ffa0c-6a93-45c9-b5f2-d70e57d3d5ca", "value": 176515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768671142, "uuid": "36871ced-3939-482c-940e-3ca6fc7d45b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671142, "uuid": "f8c031e7-a07c-4dc0-9b34-249bc0782894", "value": "windy.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db0415e7-f3e1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768681181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768681181, "uuid": "3ffb68b9-5301-4cee-9fa1-c8769525c6d4", "comment": "Malware payload (Mirai)", "value": "d7b42e87de94694463201a975d94d508", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768681181, "uuid": "ee0bf009-f38f-4424-a319-c4966dea3634", "comment": "Malware payload (Mirai)", "value": "9cbf53dc657fe63889b827dccc441b5d6004e074686f86cf1d63033acee7d688", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768681181, "uuid": "559eade2-dab9-408f-b177-902a6d20da64", "comment": "Malware payload (Mirai)", "value": "4ce6f9aee6eabb9a8bbd709fc7c6a3abfedc0ed6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768681181, "uuid": "1953a7c2-986f-45f1-a891-12bb9bc06f45", "comment": "Malware payload (Mirai)", "value": "42cf23f6e7a311247ccc7a4b5c9cf2db005fc213d8ebc4d700b04162eb189a553eed104010f26692137fc35c71d900c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768681181, "uuid": "a6e60121-fd3f-43ab-8e8f-aae0daaf9920", "value": "T1B6043A06B5CCC0FDC89AD1745BBEB136D972BC5D123CB15B2784AE222E4FE605B2D644", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768681181, "uuid": "1f5607b4-f9ad-47a1-9cdd-70a5fe7a2490", "value": "3072:QPGKnZuFYmIHyCH0weP2wnE9zeIxBTMxf7NjQbCysFm+KXgj:8GKuIHjziqbzBQj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768681181, "uuid": "4ea1eedd-cf27-4060-990e-193f4e509709", "value": 181320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768681181, "uuid": "03f4299f-0b2c-49a2-ac7d-5503779bee65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768681181, "uuid": "2ec1d37b-4760-4760-9ad3-f7522d027406", "value": "Polar.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34e87156-f341-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768612183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612183, "uuid": "c2282901-d7e4-4a4f-8316-b83bc2f37a06", "comment": "Malware payload (Mirai)", "value": "2f2f5eabf87e5426942d3cef60195735", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612183, "uuid": "04c2d650-a582-4186-b9db-06c2eced2e72", "comment": "Malware payload (Mirai)", "value": "9e37c8fb1a56b48d5f6d3805a14bb0c42b44af27141740cf3bed992bd893f053", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612183, "uuid": "f9f4750f-67e1-475a-aea9-c62582e5172c", "comment": "Malware payload (Mirai)", "value": "05b20fe9f08ae13cc264435efbf5a441c8fb2842", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612183, "uuid": "860afb4b-a1e3-46d9-8242-c334d7643e76", "comment": "Malware payload (Mirai)", "value": "f2d18df6c82562690ab7cc6974aabc55c830df35b7a8a625afee918472041d276aaf4d7661b45d36091caca1c836bac5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768612183, "uuid": "38659e20-306d-43eb-a1e6-bcc0a0c202de", "value": "T1D5A2E159BF1886CFC832293451E9EAD21252FC72F2ECCC096540C15BF4A33A92874F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768612183, "uuid": "f254b3da-8560-4891-a748-edea6fddab4c", "value": "384:MgWLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaqOKV14b+502F2vwA9dWuMW21bAKS:O98o08kxofBE+ZkXaqGbp2F2TWul0c53", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768612183, "uuid": "5de5cb88-e344-441b-a4ef-6b7216ec7362", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768612183, "uuid": "602d3691-16e8-4fc6-b745-9b41552be2b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768612183, "uuid": "bc24a0ec-f93a-4d23-9ee2-77bda0fd30e5", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f796ee17-f3ca-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768671351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671351, "uuid": "505b892a-e802-471b-8157-8fc18d980f59", "comment": "Malware payload (Mirai)", "value": "b04fba53936bde6529910c5e58df4e15", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671351, "uuid": "3bfe9e02-0e51-4426-a5ca-7c26dad09b9c", "comment": "Malware payload (Mirai)", "value": "9f7d77587a45844852d5b1b3322e308244f895cf78d741b3db12a340e8a97666", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671351, "uuid": "c4cceffd-6c06-48e0-ab26-bd2f91994c75", "comment": "Malware payload (Mirai)", "value": "260bc62d648e370ecd9e95057f0527061cf26f70", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671351, "uuid": "04690097-66c4-4922-9edc-36cd3454f09e", "comment": "Malware payload (Mirai)", "value": "7ac736fd661d58586c6e072393b97c3118f2b00f3b18a63d978740131ac16237f7a9ab3424ee80b0996d0dc73a4f1393", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671351, "uuid": "9fc15cfd-4499-4e1b-be61-0912597e385f", "value": "T17B23F1A391354BB9C02A97729DCC498CBBD7F80B694B4FEF04487DEF5807A901A119A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671351, "uuid": "1b97f23e-c5de-4910-8b41-f68053e266a1", "value": "768:U9F58wVVorA9/oSnf64qLQeGOEiAPnN1uSw5T+xVLSl5ySyrDOOmBBhGX6cfpds4:UPL19/f9eGOFAPN1uSY6xVLKyFDOXRCL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768671351, "uuid": "d27b860e-0c50-472b-a47a-9a54cff88512", "value": 47668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768671351, "uuid": "9c77bf37-9c6a-495e-982a-ee5ffc0c4f03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671351, "uuid": "9219b309-5d97-4dca-80ad-5a0f04c8abc0", "value": "windy.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31acf550-f3bd-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1768665435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768665435, "uuid": "c4511db7-afca-426c-a291-d4b3e23d6f41", "comment": "Malware payload (ValleyRAT)", "value": "42c784262fe70ab32927a37024cb6953", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sonbokli", "colour": "#1622B6", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Sonbokli.A!cl", "colour": "#AC8BC2", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768665435, "uuid": "4d29830d-4fe2-4c66-ba0d-3bfd06799809", "comment": "Malware payload (ValleyRAT)", "value": "9f843b6ded045fb017abd2144837a9985b12abc4f5df3fa789ad976fd61209b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sonbokli", "colour": "#1622B6", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Sonbokli.A!cl", "colour": "#AC8BC2", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768665435, "uuid": "16edf6cd-372e-48cd-b09c-075ad1ed15a7", "comment": "Malware payload (ValleyRAT)", "value": "978df9383415c7a547b5541d85451da2bb32a2b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sonbokli", "colour": "#1622B6", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Sonbokli.A!cl", "colour": "#AC8BC2", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768665435, "uuid": "a1916196-0154-4927-8943-6afc78f32645", "comment": "Malware payload (ValleyRAT)", "value": "9e169fb5666f0047c9d5752b88791f648a403f7541207c2ac77752ac454e6c7a65b57df6ddb847c6c8ed1bded5106feb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sonbokli", "colour": "#1622B6", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Sonbokli.A!cl", "colour": "#AC8BC2", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768665435, "uuid": "e637b777-c7ab-467d-9482-851f75480494", "value": "T11047336745862D1CFEC02430DE4015F88EFEE05F9C8FB62F1B5DC8A02A5E9496256E7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768665435, "uuid": "8175ef5d-f8dc-45e6-b74f-ad2d9425500d", "value": "d221b1dc8c3a08622f6512e7876527c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768665435, "uuid": "ef3b1bda-da31-4936-9ecd-a0064a374081", "value": "786432:U2MQGq7LRtt3W8tkaLrSsvBF1QNUw4qatZ5:U2Uq7lTv/bpF1FIQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768665435, "uuid": "ae1ff1b9-a4db-4be7-a0b9-9ed00c3a32e2", "value": 26258391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768665435, "uuid": "1cb641f6-c721-40c5-8e71-28a35e44afc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768665435, "uuid": "faf807b5-6da9-4ac8-a1b5-cdf5e550a3eb", "value": "Chromeab-x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cc47fc4-f3b0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768659870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768659870, "uuid": "3833cc19-243a-4ef8-85ed-cb60f5821a85", "comment": "Malware payload (Mirai)", "value": "ef8dc75ce622deba06f9f25e20ba850d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768659870, "uuid": "eda72d4d-5211-4b0e-bde8-2d39a86197a4", "comment": "Malware payload (Mirai)", "value": "9fab0532ae190c8bf1462fca02d981fad5ea1685304a8eee089005a34920b760", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768659870, "uuid": "3311fafe-0666-4073-b3ac-88ce3a166e89", "comment": "Malware payload (Mirai)", "value": "9bd0e9e0472c27dfa4a98b0603b36a96d02c2bd3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768659870, "uuid": "03bbd001-c30a-4060-9434-e9fd6ca9c74d", "comment": "Malware payload (Mirai)", "value": "a79783256b08ed768f160c60aad0de551d023eccd01477d1b839fcb0f7e10f91fe2d46a34eba3a33b36af477f2dc7933", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768659870, "uuid": "280c08d6-bf6e-4a5f-b8bd-aecfd93ada8f", "value": "T1523301F3A27D6234C4BEE7BA9A22016CEF066855A1479F3266D529BC14F39522B00670", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768659870, "uuid": "b05c2c30-b5cc-4fde-a6ae-31a28a92b765", "value": "1536:Avinz4MSiDeLc5TUdNGi04VghwoT2ZUueto6X:7nMMdDeLc5Idd02gqZUu5m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768659870, "uuid": "d666ff90-931a-4e62-8821-e04b056ed535", "value": 52408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768659870, "uuid": "627bb594-c051-495a-a580-62f349633b8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768659870, "uuid": "047c3232-563c-4b30-b372-c4075c16867e", "value": "ub8ehJSePAfc9FYqZIT6.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b38540f3-f370-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768632582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768632582, "uuid": "fe966d5b-3a17-4ea2-91ab-d2b51209e013", "comment": "Malware payload", "value": "927cc6fcd6a0c332d54f42adbb4c3622", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768632582, "uuid": "97865d57-b925-4581-ba6a-a7415ddd6eba", "comment": "Malware payload", "value": "a30ce984361d2929f4781e276d4eb7eae30a49c9fcfc0154a7bab69608ab660e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768632582, "uuid": "eb8ef064-127d-4743-8cae-15209d3e2c9f", "comment": "Malware payload", "value": "6aca32d6b87024ca17bf4545e11c9381a98fbc6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768632582, "uuid": "d42033ea-a740-4870-be93-a1d1e30e59ec", "comment": "Malware payload", "value": "03218148c20a92088e801c545680892487a6daaa177840090ed0efd2e759753188f6c8bb7a724abd1469bc42592c63a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768632582, "uuid": "fe4e044c-ae95-4e36-adb9-ac8da10c2012", "value": "T112F3619D766071DFC85BC8768EA81C64EA6074BB931B9203A45316EDDE0D9DBCF180F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768632582, "uuid": "df2a6a8a-8277-45ac-ac9f-605bffd52a2d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768632582, "uuid": "66b80ee0-bc80-445f-a01f-db01d884ca13", "value": "3072:O7jfQV551h9W6Rj5w8371Kg3ywJdFUFsHMKdPNbMgoy+7RLDuxZSp:mfQ35FR6cKg3HdmWMKdPNbMgoy+7RLDx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768632582, "uuid": "571e64aa-0b76-4739-8ee7-7055ff9e6ecb", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768632582, "uuid": "54816669-86a3-482e-8d44-c00062921be3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768632582, "uuid": "f7b99348-201d-4bb9-b9b2-c92399b11537", "value": "vlgoogle_update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5da84bd7-f3cb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768671522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671522, "uuid": "3c91d3d2-568c-4f17-b34a-21fcf0a2f848", "comment": "Malware payload (Mirai)", "value": "7475aa0baeae0fdcf846021cc29d4d0f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671522, "uuid": "401fe26a-5f41-4a45-b9a5-ffd52c93ac0c", "comment": "Malware payload (Mirai)", "value": "a3f8b01e09e948cb63a1dad3503ecad0d7c9a35c0c9715d036090c917e6663b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671522, "uuid": "65a92aaf-57e0-4446-b402-c1b571bd9bd0", "comment": "Malware payload (Mirai)", "value": "7fcffacdcb59b04c8ea5c88804013dc6d6de3897", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671522, "uuid": "853cd622-a1d8-487a-a163-28032d5815c6", "comment": "Malware payload (Mirai)", "value": "eabc96a34c6e77b5730142acb9f819465ecef0af2e0d6283fedc49684f4e52a48b40530471485d644c640ce3145c7258", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671522, "uuid": "a166e3e4-c32d-4517-a4bd-4dee4d207ad9", "value": "T1B8A32985FC819A12C5C5137BFB6E328D331673A4D2EE3207DE259F21338A59A0E7B651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671522, "uuid": "c7e869a1-585e-46b8-a0d2-cb59b5359d0d", "value": "1536:fOgitNptzKSJsv4v+BrG2iDwv7gO41mnQHW87Jiv9fxrOfzv0UXR:fOFtdzKIGLsZwv7gO42/w08", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768671522, "uuid": "8101acde-bc08-4569-aab2-877477e070bf", "value": 104040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768671522, "uuid": "5bd96e81-8431-4c64-aa58-631a9be3b108", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671522, "uuid": "c20cc005-7e74-4cef-bd13-dcb48abb5f9c", "value": "windy.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aa70525-f3ca-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768671141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671141, "uuid": "8d48bda1-96f0-4534-a2f7-ca505da07f03", "comment": "Malware payload (Mirai)", "value": "62dd25bdebaeacf58885d5020fc4668b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671141, "uuid": "4ad6c3d0-fa63-40b5-8df1-5db3113d79d5", "comment": "Malware payload (Mirai)", "value": "a44f6b3b80147b58d66fb84320859ff05ec2e5de2ead2cd71dce29a6d0e1db0a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671141, "uuid": "5c2bd138-bdc4-42c6-866a-93110405d20f", "comment": "Malware payload (Mirai)", "value": "ebf980df61f1d7b691f24e26043643faed8ec1de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671141, "uuid": "8d462778-3cc7-4214-ae4c-33dfea376a5d", "comment": "Malware payload (Mirai)", "value": "99e6788a1556ba1972aa9adf6173f1e0bcb54a8fb267548bc3c1b5c5f6ab92fa1b273ae4c8818bbded22d0b05db0d3cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671141, "uuid": "b9af0511-436e-4ca9-9117-80597e46fca2", "value": "T1EC935B22B539193BC4E4947622F35336F1F6438A14A88B2E7E710E8EBF156D0364B7B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671141, "uuid": "8f7c3ac4-7378-482f-9c8e-29575d7807f5", "value": "1536:DCTLZ0J9dF+/EqR9oSccUvytX5Ym5ngP5gYtGMJ:2yi+ZFaB5YOgAMJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768671141, "uuid": "b0f02228-ac26-4f00-be79-4f03eeca3326", "value": 91984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768671141, "uuid": "6dfa7b67-e06a-40f6-aed4-e7fe150d88b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671141, "uuid": "117ee93d-c0cf-4513-8a2d-a68879295078", "value": "windy.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2c7de4d-f3ea-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768685086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768685086, "uuid": "25f610e8-850d-4b6a-9bbb-93af7c32d9a0", "comment": "Malware payload", "value": "63abc45b67eef73f94dfa10d296b4b20", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768685086, "uuid": "0841c391-dcc9-4ee8-ab1d-33818b8b6ae9", "comment": "Malware payload", "value": "a5472a1ca0504c53f7429a7ef4f37db24e4d3a16a1855a3c848ac9c068b958d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768685086, "uuid": "d3cdd46f-8edd-40eb-afb5-808d34a384dd", "comment": "Malware payload", "value": "16cc8025baca8f7c8b78e213fb1aa06f093d032e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768685086, "uuid": "06751da2-331e-45a4-ab04-299f0cc7ac88", "comment": "Malware payload", "value": "ceab184bf1564c8cadbd93bd33ae8ca91d8b7819ed20bc8d84d6a44ee89f64ed553e2ecdc247ad1391d05f8da5026848", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768685086, "uuid": "eab93006-d742-4dd0-ab03-2c350b021bb0", "value": "T13C21D80CDF5491A7D2863637D51D07A0BEAFE01C0E0E7645E628240ECF245621A6B5CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768685086, "uuid": "b7a8c6c5-9d12-4bb2-949a-5a88473a2d1a", "value": "24:3FuQNUd4VtwkXcilfuAG5YoHQo8a7f9XmTu9aSg1/zzHG/8OG:U5kXc4ut8ob7f9WTbdzRn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768685086, "uuid": "343d3018-0ac9-48fb-852a-62fd757fd945", "value": 1412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768685086, "uuid": "053cc28f-9bc4-4b9f-9b36-2c9fb13c0fa4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768685086, "uuid": "e82b465e-ef9e-4e40-a817-fd9c75433730", "value": "SecuriteInfo.com.Trojan.Linux.GenericKD.34561.24950.2297", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4af467ea-f3c9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768670631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768670631, "uuid": "484853d7-890f-4375-85c8-50b72067ecb8", "comment": "Malware payload (Mirai)", "value": "148017511ef8f66365da5a7d5b837322", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768670631, "uuid": "12486c4f-ac18-4623-88de-75af779c2b41", "comment": "Malware payload (Mirai)", "value": "a6a9cf6e1b80cb0c503b44cfd05414aa1ed7a9b3d2f95b7f73b3ab895a8a0674", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768670631, "uuid": "eeba4a7f-463f-4d7e-a501-578b85781f2a", "comment": "Malware payload (Mirai)", "value": "7c3225bb7fb131cdfa8ddac78f4a0fc262251dd3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768670631, "uuid": "613fb4dd-4eb8-4af3-ab56-3c9d332dee61", "comment": "Malware payload (Mirai)", "value": "97ad69c3c5c3f393b3a76d9ff3305b9782403131b9e38c7b63484fdb6768473321c01b4a61f03527836592bf9216ef64", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768670631, "uuid": "011de7a0-9a2b-407a-b86a-d79c58c6f9a0", "value": "T1B6635CC9E801DE3CF95BE67E90130A08B921635456A30F2BD6AAFCD77C7305C9E56D81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768670631, "uuid": "e67b5e6f-0046-4549-a3d0-91a47923110a", "value": "1536:+HwL/13tMFu+sQdXvQS6Nx8HZa2g8o08hg:fL/rocCIZ74gDk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768670631, "uuid": "9eb9b5b3-0239-40b7-9c76-ef8ab0377629", "value": 69576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768670631, "uuid": "e8d29f0d-59ae-43c2-8b36-f01cbc61a376", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768670631, "uuid": "8ec7ce76-bdbb-46d5-88f9-82365d1a232c", "value": "vcimanagement.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce87193e-f37e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768638640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768638640, "uuid": "36f16d4b-c710-4e4a-ad81-3f278a574bdc", "comment": "Malware payload", "value": "0beb5b8573a79f7ca19e7d5cd08e571e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768638640, "uuid": "3ac4d038-6ba9-4b57-bd80-4c8643bf425d", "comment": "Malware payload", "value": "a708462532a9d7c69aa9b3bd7d75e9b3494c2927e6857c92e2d2fcf7b926d602", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768638640, "uuid": "3291d11c-0ca1-464c-a8aa-e3e2d8d07e43", "comment": "Malware payload", "value": "cb8f519420456be89fd723a45d0e93a5b62846bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768638640, "uuid": "60c6ce3c-bd06-4fdd-a9e6-101050722b1a", "comment": "Malware payload", "value": "718379a4ae6dab27178b204e23c27e4f5fe09c8e76e103af62d6271d5a41f461596768ba06763b320472ed3f307f8249", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768638640, "uuid": "bd84092b-bf50-449f-bfe8-51c7a1a20e04", "value": "T14A22EC17F3E5DDFFC8AA577409A313703223C836DB428783680C56543FAB29E6EA5644", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768638640, "uuid": "18712bce-ad18-474f-8331-edc740986fe0", "value": "96:B74+elu6BS8TddeqMOEtsVVQEnqN42mqMf7q1aiBcNQ2yMBxdxefnbuP:Bso0dxEtsVif42QfagQ23jdE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768638640, "uuid": "23f0a358-8aeb-4046-b78b-a2c87432b810", "value": 10768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768638640, "uuid": "a59a3e94-b052-4b66-84a6-3c15b4f8f48f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768638640, "uuid": "c2b59944-d2b5-41a4-aaba-d72e9557b71e", "value": "SecuriteInfo.com.Linux.DownLoader.2312.2596.2133", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28bfd613-f39b-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1768650817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768650817, "uuid": "301a45c4-1af0-428f-a816-ac29e2609b49", "comment": "Malware payload (Vidar)", "value": "2bde06444eded4b0dfc923494d442921", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768650817, "uuid": "14960c0a-296a-4c42-9ba6-436ec497530c", "comment": "Malware payload (Vidar)", "value": "ab81aca610472ff90f45b263106685aeecf697b75d8039e70c91e0dd9d2fc5f5", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768650817, "uuid": "0fe90809-b1ae-4cb7-a2cc-5c46eba463e2", "comment": "Malware payload (Vidar)", "value": "229e719413172bb517ee29d68374156429aa7563", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768650817, "uuid": "ce21391d-b33a-41b3-8b5d-2810a22cf179", "comment": "Malware payload (Vidar)", "value": "8832344545a9890827d86ef3eadead8fd4eaad4364f05274de6af3ddf1635714225b9893d84fdae34a3ed1c59e5ca0e7", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768650817, "uuid": "76d3e542-7b72-4012-9a47-01ee42c33a3c", "value": "T159176CA2BE004735D69BF239D4A162852330F148073525D7BB9916AA5C6FAC8173FF2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768650817, "uuid": "c6235e70-1061-4d4c-9b0b-1eaae5749ab8", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768650817, "uuid": "4290ac10-a192-4f4c-a171-c778030a6d32", "value": "49152:Nr1moEtrb/TqvO90d7HjmAFd4A64nsfJbjDyOQAy68fpKsKwbMjwrO6RLoWwsEAO:oVnyNUiO+LHwsFQHYKS0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768650817, "uuid": "2c7530ec-eb16-4efa-a300-66d2c8a771a9", "value": 19779208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768650817, "uuid": "ee9cfee2-cc86-4ddc-8aa5-0c1a0993232d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768650817, "uuid": "42b4431e-f798-4d01-9802-212506d5646a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36401839-f387-11f0-a129-42010a9c0007", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1768642250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768642250, "uuid": "13ca96d1-9953-47f6-a3f1-18098ba74cce", "comment": "Malware payload (Socks5Systemz)", "value": "1ea913947b47b9aeff1a07ff2c8da1a7", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768642250, "uuid": "398a0308-3bf1-433f-9b40-772d665fa5fd", "comment": "Malware payload (Socks5Systemz)", "value": "ac8b4a394b39560c570f0c60214322bc8f20164de2db78998d5c57c6253bc5a2", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768642250, "uuid": "562aeee1-3101-4ec9-9b98-984e1412a2f9", "comment": "Malware payload (Socks5Systemz)", "value": "b85377194a23eb899d081318e2179cf423c65cb3", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768642250, "uuid": "08ba8817-7252-4b94-88c8-51d3a557f5c1", "comment": "Malware payload (Socks5Systemz)", "value": "015148d66cf5f85f70f3925dbd0b9164e59cd9287d3090238ec283c6a4147ac623fbea970c5015258cb08d96f96e7124", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768642250, "uuid": "8966560f-38f9-4845-a435-4fbbdf24e355", "value": "T1E9063326BFE6CC3EF7124C773ACFA0097530AF957C792806749C19889E27DA1716A316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768642250, "uuid": "559a652c-7e8a-4152-87a9-34d8a6a9b6af", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768642250, "uuid": "620ee718-5637-4495-bc23-0e44b8b5c4c1", "value": "98304:Mi+etfHBbAruAANcF1Sl/vDUK2UhcEyVmqu:MelHBbRnxXDU134t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768642250, "uuid": "c4cdc539-863f-4c1a-9daa-bdd4f2a7a730", "value": 3784081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768642250, "uuid": "ff4638a5-c649-495d-bbe7-9e0e3866d02d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768642250, "uuid": "3948a3a2-5353-4b3d-821e-39dfcfd82f66", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ceff5a0-f3a7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768656112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768656112, "uuid": "b39bb794-19d0-414d-aef1-c8f4b928c373", "comment": "Malware payload (Mirai)", "value": "67d907f1760f3bb35ea196ef2e1328db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768656112, "uuid": "cfdda331-6d7a-4340-b928-97b62beec891", "comment": "Malware payload (Mirai)", "value": "ada6988d6eb995bc72cb7b28b03de559d1c1267b1b9439e2554b8362ec4e35b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768656112, "uuid": "1777188e-29e8-4a37-9470-50fbeefd65b8", "comment": "Malware payload (Mirai)", "value": "a3f38d48ab7531f080a36fc5ea3dc4cc9ab5c5ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768656112, "uuid": "3348170c-67e9-4c1a-a18e-8fd26e64b063", "comment": "Malware payload (Mirai)", "value": "a51475c3fcfd85d564f2c199e3e92574651307784384ba8a7670bda25b85c6df98b61ab46921bcd113be3340a1fb3ede", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768656112, "uuid": "ddc476c7-b1a6-4ed9-81c5-ae910ddcb839", "value": "T108E30946F8819F11D5C512BAFE1D124E37231B78E2DE73029D24AF617B8A8BB0E7B415", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768656112, "uuid": "7f8baaf5-cded-4231-97b4-f5748555322f", "value": "1536:3An3aUQYqk49M7ql/i0a5+ydsQpPXyXtzEFNaIF8kV2OiTqqPeXk/dYz5doUjG6q:UGla7XdVlXGE7adqqPeXk/IIUj14l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768656112, "uuid": "a7d7f7cb-65ba-450b-a140-b48b3559415f", "value": 146076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768656112, "uuid": "889a1fb5-c608-4300-a41b-3452d465a6eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768656112, "uuid": "332f6da3-1a25-46f3-8812-7b4b26a56fa3", "value": "ub8ehJSePAfc9FYqZIT6.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e9b94ba-f3b2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768660813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768660813, "uuid": "204428e1-8eb0-42db-a131-4fd192093947", "comment": "Malware payload (Mirai)", "value": "be61ecf48b7e0d0a621d697aca2c0a0c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768660813, "uuid": "44dc4db3-8058-41bf-883f-2e5ffe706e96", "comment": "Malware payload (Mirai)", "value": "af9f3dda226da50b6c589fb573645b697f24ceab9c5c677a024fb5b9e3baf0db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768660813, "uuid": "265e14cd-7956-4002-8e96-9921cc495fa8", "comment": "Malware payload (Mirai)", "value": "f9ce78de570151f063f75e4f5819afd145f1e224", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768660813, "uuid": "92296de4-e4a4-43bc-acb2-7b7b984e95a4", "comment": "Malware payload (Mirai)", "value": "d487a46f9a04960495f1ea006d87f9f53ba386ad6c33ed93039f080bd38ddff8d127ca50ca5415ae9d974587714aa828", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768660813, "uuid": "29605a06-16b0-40b0-ab26-3adc53fd2a0c", "value": "T14DF23A1251BD660BD0F8A63902B3975775DB7B8CA1148B1F7E3A0E8BBA117801F37A74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768660813, "uuid": "b1e459d4-f85c-4d71-a425-87cb3eab75ac", "value": "768:c77cXRjlV/DgLdpR0xz4zRGqxSBnsgjyUrn51jYPR:c7WRjlV/DgLdpR0xz4zRHl01E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768660813, "uuid": "16069dd4-b360-4574-80e7-8a2f37dbac3b", "value": 34684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768660813, "uuid": "42c48c78-4052-47a6-a115-7d6079887226", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768660813, "uuid": "f6a869d4-13a5-41e7-afcb-7ba1e4b3a933", "value": "ub8ehJSePAfc9FYqZIT6.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22ae19af-f3ac-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768658109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768658109, "uuid": "3d1db10d-fd3a-456b-84c3-b0208f112f93", "comment": "Malware payload (Mirai)", "value": "f4b6cdb949ec734ff4f1c6f36d081bb6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768658109, "uuid": "f6d41cfe-09fe-4c9d-8d23-2d58a655aae0", "comment": "Malware payload (Mirai)", "value": "b08a239e40246fa2b693df1001971eb0dbd974dc467259a15a0ece8eeb73c1fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768658109, "uuid": "d2dc3b55-a758-4dd7-81fb-f2451c79f1af", "comment": "Malware payload (Mirai)", "value": "a753d16dcbc28c2d814b68594d33806465fc4ec8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768658109, "uuid": "10b66655-c44a-4dfa-8020-062579f64cd3", "comment": "Malware payload (Mirai)", "value": "c7a4fd467161bbb49df773bb7ad404a92c668ec290eb6ab45a2f5c5e2971c4092d3842f232d4024fa844b9f35123d672", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768658109, "uuid": "b5bf4bd3-7c25-4350-9e0e-627bc09a60e6", "value": "T162B3AEEFF34B1590C8628AF017D78BDE2E6322119E6BC5F72C0E563A19791DF490A391", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768658109, "uuid": "9b7e751c-f620-4c54-ad56-bede53659494", "value": "1536:/MXZWfjJOCj47WDLDT/vLikkaeXSbT82Q0mkwlgQ/LW5:1fjQM47WDnzjJWXS3bJ4gQq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768658109, "uuid": "ab6991de-1e8f-424a-a933-52402f4b19dc", "value": 107840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768658109, "uuid": "99516421-e90d-42f2-9473-f5de3283b069", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768658109, "uuid": "21775f1a-0d9c-43f7-879c-e15dc4378c89", "value": "ub8ehJSePAfc9FYqZIT6.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a43ee79b-f3cd-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1768672499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768672499, "uuid": "59aee863-9b0b-41f5-a6b1-30fb59370ee0", "comment": "Malware payload (AsyncRAT)", "value": "3db74832b4e636bda7b88e1ea11103fd", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768672499, "uuid": "dc75f5aa-e5cd-4730-8ab7-a6a5ee056a96", "comment": "Malware payload (AsyncRAT)", "value": "b1a89dd51a8818d41ee607a2997eb4c8b9201f43c1004247114d4ae0aec0ddf0", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768672499, "uuid": "ea91e228-3b02-4900-9f9c-97be0d4f5d7b", "comment": "Malware payload (AsyncRAT)", "value": "1ab7b6f593fdab7974138c1c5e2e094ae230d6a8", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768672499, "uuid": "c1f172c8-6678-4456-a973-f0edb2ee40de", "comment": "Malware payload (AsyncRAT)", "value": "82d08e11130558ffa0aa86670d555ee0749c636210c6649604cfcc526821a54ebafd29401d1d0e16216f7f1f867d0651", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768672499, "uuid": "d154e731-fb9c-4ba9-996a-f53e00d4bafb", "value": "T1D8537D003BE9812BF1BE5F78A9F2614146BEF1677203D69E1CC441DB5613FC58A826FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768672499, "uuid": "4c4b6c7b-8f79-4132-8631-a7a69d3f818f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768672499, "uuid": "c8d921e0-a40f-427a-96d8-71eaf85f71dd", "value": "1536:vu/8IcT8XG29cfd3I23bPXyXCdlMrXdKPBzc6p6RlcU/uJkgfC:vu/8tT8XG292d3I23bPE3Dmp6RlcU/8q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768672499, "uuid": "9f6ac364-0da3-444e-9196-157910c3221c", "value": 64512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768672499, "uuid": "23c75531-05a7-4a1c-9061-017a5924614f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768672499, "uuid": "638b5a14-b5e5-4912-9c41-c44cad9141a1", "value": "Google Earth Pro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "787396c3-f3ca-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768671137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671137, "uuid": "641b25f2-7f74-48f1-9d43-0e23c0556890", "comment": "Malware payload (Mirai)", "value": "2369e6b7fa9b436b139ab0f06f6a1b53", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671137, "uuid": "1a30fa42-eaac-4671-85a5-7a2f4a70cb8c", "comment": "Malware payload (Mirai)", "value": "b39c12d8177806242ad97992e0cc0d6daf4c872bb7cb3b131309d6d79206ef9f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671137, "uuid": "61aca984-5c08-4b2d-803d-ca828e266881", "comment": "Malware payload (Mirai)", "value": "08b7ca72bd60831c710f13d9223e528269f120cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671137, "uuid": "cb9c8531-54fe-46d3-ab78-c4bc0fdcc988", "comment": "Malware payload (Mirai)", "value": "90f2334d11cafddaba6947e02d277868f9904455a7d0589c02268d3f279a7d67609c2b1a14ce077c5dab506f9fc78467", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671137, "uuid": "92425f26-0762-4d5c-9c28-1ccd51329511", "value": "T121A32946F8814A21C5D512BEFA1E318E331357BCE2DE73129E14AF3173865AB0E7B616", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671137, "uuid": "80cd14a2-4e2a-4f01-9325-e7d49aa65dc9", "value": "1536:AAnTSlOO7kf5J7ZLBpqppsGBgyQxJ4s3k77axrtOXrDsRilp+xfVMv7fh5GYWy6:yl5bppsJj4qk77ax4p+xfVkbhULy6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768671137, "uuid": "63a5ed6a-ea11-4a5e-a2cd-29e83cd6c638", "value": 99804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768671137, "uuid": "c335cd3a-a4b8-471f-88d0-6a74269a61f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671137, "uuid": "08f50957-1ba6-4e30-9d45-d0b404bac230", "value": "windy.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4857abd-f3ca-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768671345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671345, "uuid": "75d9a735-9dc2-4d49-bc99-904e965c22f7", "comment": "Malware payload (Mirai)", "value": "27c3f0fb6eb4f265f72de03071410fcb", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671345, "uuid": "df89d7bb-b4c0-487b-8b4c-08cf54ba49e9", "comment": "Malware payload (Mirai)", "value": "b3a4748362355f8b0ded11610167202e0d54b514d575fe001b005937d0bc1c89", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671345, "uuid": "c22b8c11-efc6-4eb9-b6b3-31b31a1d1479", "comment": "Malware payload (Mirai)", "value": "afa3a05c97e027c444f666521d92f51df72c9bdd", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671345, "uuid": "f69ef95d-d8cd-4b89-bb09-14b0c1381b6b", "comment": "Malware payload (Mirai)", "value": "6d83e0763371756fdff4885c1e80454699410ed79b68412d60277d11f177ae9bf0cde502e61f578aa292a80d3f1616a2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671345, "uuid": "3fed7cb1-dff2-4a6b-b16b-95aa3caabd05", "value": "T1886180E6211217BA2A79DF23727D45947193A0A618EF7F04E6CE34F884ECD66F045783", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671345, "uuid": "e4b7939d-8681-4e28-8e32-90ac90c59dd2", "value": "24:ItisL3rTCsbvG2JXLB1LBgNIxksOKd13jLz3v1Y:izL3fTbvG0bnL1JOy13jLTNY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768671345, "uuid": "6bd7ea73-b28e-4050-898d-61044e8823e0", "value": 3415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768671345, "uuid": "baa4ee96-24d8-4b6b-9f9e-6ced3c0e754c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671345, "uuid": "d92c4dea-ff40-45f2-ba70-a4c4340e8c13", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54c092bc-f3d9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768677520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768677520, "uuid": "ad5fad94-acf5-4cc3-8b45-e67041d9688f", "comment": "Malware payload (Mirai)", "value": "6f7ba793f1681129620d5a1bf5c70363", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768677520, "uuid": "27918377-3aa0-439f-b87d-2bc978a6e31c", "comment": "Malware payload (Mirai)", "value": "b58a3655eba05d159b36d7383bdb34338edd02bd261fe013442db144d1ea495f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768677520, "uuid": "4281f32b-8cff-4253-82f9-009b419cddd7", "comment": "Malware payload (Mirai)", "value": "264e6d343ad086bf91a4af43751379e906ace6ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768677520, "uuid": "0d37cb3b-13c7-4b5c-aac9-131c8774811b", "comment": "Malware payload (Mirai)", "value": "f836d97f9b41abc5dbc8dcb470d2767320d6bbb61944f602b395e7345a052661ff04363492b0e6f9bd2e27a784b8dc79", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768677520, "uuid": "52bbea10-386c-43b3-b97f-bf11f39464f3", "value": "T156738C93CA792E68C008E6F1B4B0CB795F239514C5575FE992A6C339D053E8CF84A3B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768677520, "uuid": "62edf56e-2072-40a1-9b66-727873adecf1", "value": "1536:BJzdPreRkJ6yfmAmBMCEBkvYEkKvbjTk7bzxd++Ck5YXyyL8U/x:Zr3ODoBkv3vbkrxd++9Y55x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768677520, "uuid": "353d84d6-cf79-452f-a8c6-5278c06c3766", "value": 77928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768677520, "uuid": "fb74accc-ad6b-4110-aca0-d30ed8787467", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768677520, "uuid": "c4fc24e4-78d0-409d-989e-3b7ab3165100", "value": "2016Nwjsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1a1134f-f3a9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768657087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657087, "uuid": "4bcb0cbe-8adf-445a-ac9a-14f67c8615c6", "comment": "Malware payload", "value": "9ec617e5c84770c0fc7f4941c1fb8f4a", "object_relation": "md5", "Tag": [ { "name": "212-34-136-81", "colour": "#0DC925", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657087, "uuid": "b92fd47d-7145-4b63-a628-f61a5162b2f2", "comment": "Malware payload", "value": "b5fe7a7e033cb9fbc377cbe9c3e521f13bf1b0469db9c89363b5139cdcbde0ca", "object_relation": "sha256", "Tag": [ { "name": "212-34-136-81", "colour": "#0DC925", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657087, "uuid": "276d86f4-1142-4dd0-a31d-ac697ba4fdfa", "comment": "Malware payload", "value": "99def0269ad466ddaa73c224f7bc1f5565eb8f87", "object_relation": "sha1", "Tag": [ { "name": "212-34-136-81", "colour": "#0DC925", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657087, "uuid": "3b628c57-c1c5-4c07-841b-c51899242fb3", "comment": "Malware payload", "value": "7ac32ce92806f7ccc477ea6d66710bee89ad50962ed9d67b2284711432c0e13d0a5dbe97c3945b5af3886503572983b7", "object_relation": "sha3-384", "Tag": [ { "name": "212-34-136-81", "colour": "#0DC925", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657087, "uuid": "81d594ac-c4f5-40eb-8ead-1d7996b0f32a", "value": "T17D369E31E542A165E8F924B3A3FE4BF748EA8D186725C1C3A5C478D486713D332FA25E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657087, "uuid": "d8788e91-783b-42f4-9c4c-0b334eb46080", "value": "88e87de6c1cd25baf0c731a778bb1647", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657087, "uuid": "10a06a50-2bf1-420e-afdd-3498dec1d0dc", "value": "49152:Xyh7gD5ol33dGJZleQg4KQYi4i/hoAVIuiVHP2nJMTPsXy9p4mY6CZ4E45TpKqbS:sZlkO4KQYi40hOuWH+JMoXQ1YT4E4z2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768657087, "uuid": "1c7f191c-fce0-4e51-ada0-3e7dfeac6ae5", "value": 5010000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768657087, "uuid": "f22e0ef0-a328-4d1b-846f-b3e6a590baf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657087, "uuid": "9e84590e-cc21-4ecd-89c0-9012888f70a4", "value": "python39.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c19b38fe-f3aa-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1768657516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657516, "uuid": "8bd78786-0c2c-469f-9235-034b169d0236", "comment": "Malware payload (Vidar)", "value": "42ce8894a0628de66d81c10563c03592", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657516, "uuid": "af2bce42-109c-4999-b67d-7080c4da463e", "comment": "Malware payload (Vidar)", "value": "b62e4b24738e347469ea8639505cb20e8e14eb6d4f386c5ef902c687e45c1eeb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657516, "uuid": "6d9bc5d9-8c30-4794-bcd2-9865073587c8", "comment": "Malware payload (Vidar)", "value": "bfa7330837b09560f3e409755595dd43a2f3ebf5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657516, "uuid": "ae3a914f-1114-4936-9e2c-5912e796e221", "comment": "Malware payload (Vidar)", "value": "e5e986b35edb78386f79ec9a8136f7b5079dea5c01d197efaee5680e6a2ce709afe6a72a6e50929bdd6d91aea97f28d3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657516, "uuid": "62e3ad76-04f3-425d-82a4-8b45c130454c", "value": "T158667C92FE404675D59BF238D8B161893230F444073216D77BA65BA94CABBC8173FB2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657516, "uuid": "f2bb8815-f22d-4754-a8f3-f02b3a488215", "value": "da7f8acb6151c95be088a02465d68ef8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657516, "uuid": "0b1925d6-0cb5-4376-ac8a-ce89ddfba5d3", "value": "49152:Gl6++iWRrb/TPvO90d7HjmAFd4A64nsfJ7J4/VWqEn0m+tya718PjqGVMHUAK1Aa:q5J4R/HNa9yn4hXh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768657516, "uuid": "b8a15cb7-030e-479c-876c-fe624eb4b583", "value": 6969472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768657516, "uuid": "51fe5fa6-c59d-41c9-aa9d-3f5cc8c32f99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657516, "uuid": "4d32e1be-a975-4d15-ae3d-f887f70122cd", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cf76edb-f3b2-11f0-a129-42010a9c0007", "comment": "Malware payload (ACRStealer)", "timestamp": 1768660730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768660730, "uuid": "f5bf318d-2710-4d88-b104-9e964ced23f5", "comment": "Malware payload (ACRStealer)", "value": "bb1c67bffb35cb1976d260f5cd319ba5", "object_relation": "md5", "Tag": [ { "name": "89-110-64-191", "colour": "#0B7FD0", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768660730, "uuid": "028d9dad-c608-40b2-a74b-be036816131c", "comment": "Malware payload (ACRStealer)", "value": "b6992a4eaac69e053158e017749233db2f13f73542343916365d95adb22e1343", "object_relation": "sha256", "Tag": [ { "name": "89-110-64-191", "colour": "#0B7FD0", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768660730, "uuid": "765e1ab5-a8ef-4edb-b299-727c8a671306", "comment": "Malware payload (ACRStealer)", "value": "469982468ae5899a43d61b352758051f7c09a9ad", "object_relation": "sha1", "Tag": [ { "name": "89-110-64-191", "colour": "#0B7FD0", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768660730, "uuid": "335f4aa6-9cb0-484c-9752-3a34de2d7dc7", "comment": "Malware payload (ACRStealer)", "value": "2f2e984d6f09ee8d1beb2bcb93e37c387060f4d8ccc089a70b89019edf1bd60b74a26be5f4244b0ae25af88763018931", "object_relation": "sha3-384", "Tag": [ { "name": "89-110-64-191", "colour": "#0B7FD0", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768660730, "uuid": "fd225ed3-aa44-4748-9d93-9c331e647bb2", "value": "T1C8C70201F7C259F2D9C340B0647EB73B8A3AA628477846F397A91EC9E8352D1357B385", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768660730, "uuid": "75bc93dc-637c-4592-8c84-195ce6f6fb4c", "value": "e379fb969875d14697df6d344b4a50a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768660730, "uuid": "4c64eb31-0eb6-4727-a261-8f6ecced7bcd", "value": "786432:JspEFAtziKdj0R2jLUfJ/R476iKyDRlULWx3bgTs0J+8aF3ua4Xs/kDeZ/9O:6tL2E76iKyQLAqAXF+3mjXO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768660730, "uuid": "bf0c91a8-ecd8-4d39-b17d-455c16a1b400", "value": 55786312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768660730, "uuid": "066d6f64-6b6a-470d-8414-183f93ac14c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768660730, "uuid": "bb718971-ef48-40bf-8eec-0c81256d285a", "value": "KMSPico_App.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd87c67f-f3ca-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768671361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671361, "uuid": "e050f5cc-544c-420c-b3f6-0c1ed0997994", "comment": "Malware payload (Mirai)", "value": "21784f1b751aab51b13741745c00ac05", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671361, "uuid": "86174280-c18d-427d-8ab0-0e06015c052f", "comment": "Malware payload (Mirai)", "value": "b7385aabb036cc77a77ddf5a2d0f9e0b8a85e33cfe2267b049d313170b8cef39", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671361, "uuid": "416014d8-a43b-44ab-9c84-b699be8f2cdd", "comment": "Malware payload (Mirai)", "value": "33425cbf0eaecaa4f17e4e261db9d2748d236f52", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671361, "uuid": "65e2dd4a-7182-406f-b4d5-ea03bd7403c3", "comment": "Malware payload (Mirai)", "value": "e6e1133b5970236e5febaeda9906f2be64e75631c62875c1916e049197ed4936cd58a5693ecdbfc246ba3ec7545093e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671361, "uuid": "59be43a4-9351-4f44-8a42-ab736bd1653e", "value": "T121A36C11B9381E2BC4E0A43612F37726F1F6778A10E8861E7DA10E8EBF256D036577B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671361, "uuid": "d890cf13-c2ee-4fc4-b3dc-5a432b56dbf3", "value": "1536:P88ZSoqLys/dWXfqvz1+m1psvePewZFtf8DAN+5ZnZHTQ1vbAtLezTGyNg:jSp7eQF1RNmZZzBMTGyNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768671361, "uuid": "10480987-ca86-4616-bca4-ee12219ac5f4", "value": 104588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768671361, "uuid": "f101dd6e-b77c-4fc0-a17f-66a8ea754cb0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671361, "uuid": "27a5f821-237d-454d-b01a-4223fe8c5ba1", "value": "windy.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b64e531b-f3e1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768681120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768681120, "uuid": "482f14a1-8fbf-4844-ab92-4d26f3bbbced", "comment": "Malware payload (Mirai)", "value": "259932c139baaa6d3f47b20651d23966", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768681120, "uuid": "34d74be8-78de-4d0d-8bc7-2e5804a85afe", "comment": "Malware payload (Mirai)", "value": "b784633b94f332feb9cf753e478adb69f8cd2a80b90293f06ef4ce7bcb1eb690", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768681120, "uuid": "5c90e3b5-e18c-45a9-bdba-72ed492a8e80", "comment": "Malware payload (Mirai)", "value": "ef8ba3dfd33b2323eb203f90d8e3c46d0cba91fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768681120, "uuid": "35b06a5e-2738-4d70-999d-bf442c2bd5fc", "comment": "Malware payload (Mirai)", "value": "a0f2ad65a805f0b5bf7f1197bb6a29d7a6cfa33423645c6b4a068a74c7a26509c2fdc47910919d9ac5246ae8dc53c433", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768681120, "uuid": "8bad4bdf-f046-483c-8e11-fc9778206918", "value": "T1456302DBC232D1A5D9F33F362C5741B4F582547929922B5F0E417029DDAAFF11E19A80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768681120, "uuid": "10765437-9e10-4e6e-826b-3c29050a8aeb", "value": "1536:v17cJ2kCGS4O3We3nUGzDfWWUaXmrNjwPk2Sv:vuJCGS0QnUKD9mrNkMvv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768681120, "uuid": "89d50c0b-738a-46e8-ae4f-fda23fd226c7", "value": 67792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768681120, "uuid": "c0b86ec9-faed-4d5b-bdac-d1ca58507e1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768681120, "uuid": "2b76d71a-e85b-40f0-809b-b0dfa71cac7b", "value": "Polar.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7117dd6a-f341-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768612284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612284, "uuid": "8c7040d9-d742-4c64-90e6-0968d04d3c12", "comment": "Malware payload (Mirai)", "value": "5653a25b8bfd08101f513301873e1ce9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612284, "uuid": "df3e7578-0681-4e1a-8e92-fa99a0e68bde", "comment": "Malware payload (Mirai)", "value": "bc41240cddc621b5e67eda06b799de84221c9ad3ddafbb69da1cc49eaa48ad6a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612284, "uuid": "d0543e89-b45e-44bc-abab-e7d41b9fd8b7", "comment": "Malware payload (Mirai)", "value": "f2c758bf79295d06f797bddb922ee6769621d02c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612284, "uuid": "207c1ea3-2364-465a-9b93-233430d54702", "comment": "Malware payload (Mirai)", "value": "3a53572fc90d4674bd1cdbb5b4ec73de1a985bc07dffe9d0e00fa8d43723f2e0b8d53f0d4cd2f4097cac80a999144b0b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768612284, "uuid": "b29df9b7-e8a9-4bcf-826b-bb675c7495e4", "value": "T17D431891BC819A23C5D4137AF56E56CD372433E8E2CF72179E214F613AC682F0C6AE95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768612284, "uuid": "afd0270e-b342-4a4f-907d-e175af2679b6", "value": "768:raehM993TLSmRTIrL8Fvvhp9H0HrZQ8yoWXagcLVPWtuQ/C71mA2EDEy0eYjW9TF:/M99jmL8BZp9IFUoWKdYuvQ5KIqkypZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768612284, "uuid": "1bd6034d-43c6-4955-b964-b45e3ca55adf", "value": 56160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768612284, "uuid": "a33a1313-367c-4297-85da-4b58f4b4aa03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768612284, "uuid": "6ff13c18-d6b8-4044-bdab-1805aa7f52d3", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bcb2b9f-f376-11f0-a129-42010a9c0007", "comment": "Malware payload (CobaltStrike)", "timestamp": 1768635012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768635012, "uuid": "e7464ff1-5127-4124-b55b-a73952511858", "comment": "Malware payload (CobaltStrike)", "value": "5a1568c9b13f897df01eb2b16535d290", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768635012, "uuid": "3bdb833b-9442-47e3-9ca4-6ea88b7d3287", "comment": "Malware payload (CobaltStrike)", "value": "bc5cc133d250058080a284fb1f6ce394f588b8363d4ec7fa8af163acce309da6", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768635012, "uuid": "49953789-038c-46e0-9efa-f733bfce030e", "comment": "Malware payload (CobaltStrike)", "value": "78cab8dc9c7cf40c2f135c9078683d5f29104837", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768635012, "uuid": "a547efbc-c05a-4d7c-866a-6145e2093ee2", "comment": "Malware payload (CobaltStrike)", "value": "00147c388481171f5edf7543dd56c674f5adbd78b553c308385c090103d466e6ac36dacd8d0e42aa18140587d47d0bfc", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768635012, "uuid": "f3bfab33-b1ec-422d-a436-ae00cb634eef", "value": "T16F92C93FE71368E9C506D57845FF2732DCB13DB385A7972E2724D2B42E106A42EAE910", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768635012, "uuid": "732245ff-02da-4f14-bc82-6881c95e0646", "value": "147442e63270e287ed57d33257638324", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768635012, "uuid": "08a01b7c-5329-463d-9b12-c380cfe631de", "value": "192:qV7qaCF6Op1t2dobVXujRDcBaXWQjwOT/2Nxp55WF8qa1Dojjgi:EqaCF31cix+Dc4zjMv6FF46gi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768635012, "uuid": "c6536c8f-3c76-4dee-a8a5-151b7a32d728", "value": 19456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768635012, "uuid": "4035271c-f20e-43ad-aa1b-35e43b8164b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768635012, "uuid": "48bae603-6617-4c54-ad60-9e8d4b533e99", "value": "bc5cc133d250058080a284fb1f6ce394f588b8363d4ec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "391141ed-f341-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768612190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612190, "uuid": "7bb1ad75-e7a4-475e-b9b7-ff9b04559cd9", "comment": "Malware payload (Mirai)", "value": "e163bfbe3b24b8e98bf9546a62fa3b55", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612190, "uuid": "b59def52-5b75-4828-8979-6ccb0497d6e1", "comment": "Malware payload (Mirai)", "value": "bc91fd96a029e64e1f149abb551eb674a262e882057e65b2a6c6c34ccfce845f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612190, "uuid": "2e3d15ce-d04f-4c2c-9296-faaf275838fb", "comment": "Malware payload (Mirai)", "value": "083bcd7006fbe8e1cbc435b8a7f03c8a3ddeb38b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612190, "uuid": "bee0f157-9aa3-4d9e-83dd-8bc3a4dcd036", "comment": "Malware payload (Mirai)", "value": "4e7bf3e948e5b3107b2579b9b85c49b9ee5fa6e4db0e9ad79aaa4ed7c8a8ce85f6028ab39eac321c2b4a6a806838ad46", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768612190, "uuid": "949c83b2-63aa-4af3-b279-765199efffa2", "value": "T106C2D0E0B726FD31C4206C7DE52A4D8A3A51067C90FF343764258D359EC1A5B67B88FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768612190, "uuid": "6e937705-2ead-4732-b861-4d6db8d44ef1", "value": "768:DMKyhegCCMqfizjoNpd2vJdX6vwry9q3UELuV:oKy4qfqoeJdXWgnL4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768612190, "uuid": "61135649-cd9b-4781-996b-285bf1b43103", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768612190, "uuid": "9426cfba-0514-4324-a416-eee7c2a3d5b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768612190, "uuid": "ffbf406d-0fd0-40e6-b698-d5e524db9c47", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4d94d91-f3e2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768681600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768681600, "uuid": "7e190324-8d09-4ccf-9c47-64845342fb3c", "comment": "Malware payload (Mirai)", "value": "107c7967104e8f8f9b5e2bf5df4c75e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768681600, "uuid": "eacd772f-1c78-4a70-ba72-157309ba83af", "comment": "Malware payload (Mirai)", "value": "bd52db8e0392c1cd596862981f2c0951829d5c379f4b6e2f81e1f52d032c82ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768681600, "uuid": "bae06918-b321-46c8-9059-74373074f205", "comment": "Malware payload (Mirai)", "value": "6116e78f7449c24ddb0eb1a1361a9d59508a9168", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768681600, "uuid": "bca3e39d-e706-48fa-8f23-facef488de9c", "comment": "Malware payload (Mirai)", "value": "cb7e65ab3b32d7fa09cf0c85329439b208634b60d63bbd059efc4c0d22ba35bb98f4d510246e2d27d9bae55b46637fe8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768681600, "uuid": "ef869eeb-2a09-4647-ae6f-69a51f5feb4f", "value": "T1B363022AFE3F7C91C6B30E31CB2840591F593EA544DA7297D32D057BB65909AC1F8903", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768681600, "uuid": "c2bc5bc2-5c29-4c64-8332-de7dee983d0d", "value": "1536:zNxKLLaZw478FMTJ+cBlGyo9gB0wpB5q2w/DfXMNpzPvpLqO:zsLs7bJjPvULXkpzJL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768681600, "uuid": "099c4d4f-794b-4f14-aef1-732daece1711", "value": 71376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768681600, "uuid": "c322a465-ad8a-4ef8-967a-3ffc2164b2db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768681600, "uuid": "bf7a20b8-8faf-47db-b90d-8cca423c8cc1", "value": "Polar.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa5b3b51-f3ca-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768671355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671355, "uuid": "aec1baef-6dfd-4af7-9993-d0ec104b73f4", "comment": "Malware payload (Mirai)", "value": "ceac77f6c3e5b85f98a5352c4cfa3b99", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671355, "uuid": "75898ea9-60f9-412f-bd52-1f9a68eb4cf2", "comment": "Malware payload (Mirai)", "value": "be7af8cd4e9fdd06112eef506c2da07821223bc064274f87550008086373e5d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671355, "uuid": "49c21e22-236f-4270-871c-973fc37f485a", "comment": "Malware payload (Mirai)", "value": "4541a6a4d606357d7346d02def8cdea3f7b7055b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671355, "uuid": "26afb644-2b42-4a91-ada6-c616254776ab", "comment": "Malware payload (Mirai)", "value": "487469ecc4fea804cd977cd35e7058c056e6bf0eed85b230f53575b6f337ac11fab8501491c5680e9b8dd2952bc84f9a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671355, "uuid": "dd5a5e56-49ff-4840-b399-b93a5197fe43", "value": "T15E23F15E1B59CFABFA43E5F5CCB84BB17B56CEE3F4C35808611C4912DD0A1286981AC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671355, "uuid": "8e17dff0-f59f-4b7c-97a2-af367fe2d100", "value": "768:psCJp7UKbxaFnzkH+GcUn8GKa9LtYE2a4uA5KaXaEh2qsBGgChjlMmjepXZTveQr:fp7daq+76htY6dA90LCDMzJNVJuyp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768671355, "uuid": "22cbabfd-ac4e-4e72-b3e0-ed5fa6d415fd", "value": 49080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768671355, "uuid": "ab6eceb7-2638-46c5-87cc-d1d18818a6b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671355, "uuid": "62687059-a798-403c-b057-5c830c5290b1", "value": "windy.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a771454-f38e-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1768645264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768645264, "uuid": "5fafd8f2-23b5-4779-8372-87be36977373", "comment": "Malware payload (Vidar)", "value": "d3fca964d4ab0682cde45c00b34560b4", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768645264, "uuid": "b2f25c25-4e35-49fe-b892-9f49739ee800", "comment": "Malware payload (Vidar)", "value": "bff29fe3347b1b6086e1e29964cbd808e20cb95089f1a4fa37731380b81648e9", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768645264, "uuid": "c5ee29a4-fe67-4bdc-b8c9-27dd40ca89dc", "comment": "Malware payload (Vidar)", "value": "b002f69ac902129c75f19d61b0848887a047edf7", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768645264, "uuid": "9450d5c1-7116-4423-9f97-420993b4532f", "comment": "Malware payload (Vidar)", "value": "c40f76d16a7be7267b111109d3b6a377b891d9c01de936b0abef91471d452089b9d54e0b3ea12640845c28019ac1281f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768645264, "uuid": "781cf93f-d112-4d9f-8991-34c1f38d0d22", "value": "T104A64BE2BE404735D6DBB339D4A1215A6230B548133514D7BBA91BA58C2BBC8173FB2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768645264, "uuid": "e0da83aa-4183-4d33-99e7-89fad2a6f9c5", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768645264, "uuid": "fb3c903c-1ddb-4b8f-8d7b-cbbf566c3fb3", "value": "49152:KCubmKt98N94rb/TBvO90d7HjmAFd4A64nsfJfCQp6f/ew1ExUzJ0XIFPD7k0MJV:HNQjarL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768645264, "uuid": "668f153a-d357-43ae-b625-7e83f7b36c3f", "value": 9879168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768645264, "uuid": "45c39661-66c6-4833-9d11-8be38fd16488", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768645264, "uuid": "59d9b7ba-3fec-453b-8990-e7eb07735e4b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64326160-f3cb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768671533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671533, "uuid": "f5946805-fe3c-4b19-b132-d56762e953d9", "comment": "Malware payload (Mirai)", "value": "d3f5ba446ffb0c890a3aaec3e41e29d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671533, "uuid": "52741ada-9d64-4664-83ba-e9e90f735d44", "comment": "Malware payload (Mirai)", "value": "c00583ce89489bdeb4a1394cf7797facbe1726857301c1ba37757a5a43d22b42", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671533, "uuid": "d81862a7-5528-4b23-acbb-c96991ec36e9", "comment": "Malware payload (Mirai)", "value": "febe0226d50ab80c6daff9e023e95851105027f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671533, "uuid": "7bfdb85e-249e-49d1-8a7e-d04af7bafcac", "comment": "Malware payload (Mirai)", "value": "88953ff3ea086298f9bf250cd30d27cdeec55f2b8d05910bdf7f89127ddf8b375954cec223dc6279d02966b7db1033c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671533, "uuid": "46b99541-4976-4bd7-aab4-b50b6a2b2f78", "value": "T142D3E709AFA10EFBE86FCC3706A9270529CD691622E93F757534D81CF24A28B15E3D74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671533, "uuid": "55de8f89-b52c-4e65-9779-e13a7876391d", "value": "1536:UxZ6TsX1wdptd2IwpQT229IK3W6u2lBwx2Ztak9pXn0BOZeahCq7J1DIGq68vYFP:KRGDtd2IwpQT2jn3wpX0BOx7J6hyeuh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768671533, "uuid": "f9f859f3-808c-4444-9bab-7e61f28cf0cc", "value": 133644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768671533, "uuid": "1e0cc4d4-5d73-4645-934e-104d898bb61b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671533, "uuid": "96dd0ceb-3139-42e1-8aa7-9976d3de31f5", "value": "windy.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96b4e5bf-f3ab-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768657874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657874, "uuid": "1afea809-c30d-41c9-a4cc-7cc33ca03560", "comment": "Malware payload (Mirai)", "value": "ef65456b5b7e291674864487663c192e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657874, "uuid": "e75016e8-6ab1-4452-9f1a-6086e5f7c7de", "comment": "Malware payload (Mirai)", "value": "c0e4274985269149219d7a380e55a32a20e3133f6c43e627fed4df431364ebb6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657874, "uuid": "5adbc408-d513-4832-8de4-8cb5c65ed668", "comment": "Malware payload (Mirai)", "value": "3783327c8fd80f48bd7ebbeb256eed90db9b9e1c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657874, "uuid": "65472a11-1e01-4c41-b70b-ec7b45ee40a7", "comment": "Malware payload (Mirai)", "value": "c2f5c7b2075f1074bb3edd4e6270bd1c7712c6a5731b58e1fa6f0c1d1a1c25c13aa45d81d61c53e772acd177bf99ab93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657874, "uuid": "45f41f89-4920-412d-9ad6-81ef824cfd27", "value": "T17A330108A74A6A6DD86E56F175457ED43CD4CB3A2A2A1E8702D9FB5BD801EFC01C7CC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657874, "uuid": "c779f698-3d0f-42fc-a03a-3b7bae7ffad3", "value": "1536:9W8Rky8Ip/Ja5mETpEG8WdcXrHKtWSnWVJuY:3oItJa5fTT8WdcbHxqWVQY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768657874, "uuid": "f5c54b49-f963-496a-98fc-5653a06661a1", "value": 53884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768657874, "uuid": "60868352-5ae4-498b-b080-a8f4b8ff029c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657874, "uuid": "9b9f7cf0-d498-4c0c-87c6-a42fe93405d0", "value": "ub8ehJSePAfc9FYqZIT6.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc78f653-f3e1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768681184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768681184, "uuid": "fa9f5b1e-9f5a-41f2-840b-b7e9bf25485b", "comment": "Malware payload (Mirai)", "value": "5f5a46a2e2cd443325bd85e119ac4d61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768681184, "uuid": "451a17d5-f087-4c59-9974-9dc6257b9f5e", "comment": "Malware payload (Mirai)", "value": "c1dfa7a522f8b3c68d79171de45f1e17114f2ed24d67af531309375a58d7709b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768681184, "uuid": "219e0494-d6f3-4c95-b992-f6a7991c9039", "comment": "Malware payload (Mirai)", "value": "0cad84bdb09ddb28707fba17164a91f143ad5151", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768681184, "uuid": "3ca21b08-4b41-4bc8-85f2-652a8030106c", "comment": "Malware payload (Mirai)", "value": "a47d5983c8db32439b0ff71a199d6018e0eb38d0032ca83bcf42f7158a01690e0b99afb68e7902dd288c01deaa2dc5cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768681184, "uuid": "8bd62e04-c6ad-4ef0-a606-82e705cfa09d", "value": "T19934E70AABA10EFBE8ABCD3706ED1B4128CC551721A57F7A3274D914F14B64B49E3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768681184, "uuid": "b2cca48a-bcfb-4539-9b03-9e0a798d75fd", "value": "3072:0suyb9d+PBned2cOkbXPNgOXjJ27iqnyTzTehWpVyK4UJJx:0Ob9d+PBnabOkbXVD47TnyihQqUJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768681184, "uuid": "04d2492f-191b-4b00-9ad4-40ad6877bba3", "value": 233096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768681184, "uuid": "b279c61e-63b9-4096-aacf-0c56300ef0f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768681184, "uuid": "65a68276-adb0-4006-a903-93ca983c5252", "value": "Polar.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33199b98-f3b1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768660284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768660284, "uuid": "dce78ee5-5735-4844-abf6-0e04bbd8d54f", "comment": "Malware payload (Mirai)", "value": "9cac6654d57bc6956de6a6154db5d629", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768660284, "uuid": "d663da72-db1e-4035-b0dd-6fa0da0121aa", "comment": "Malware payload (Mirai)", "value": "c2aa8a97c459a9f4c7fc63744385ad445e255956a7314f36c1199e6a6e7bccd7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768660284, "uuid": "73a9b1ff-6153-47b5-9c8c-e00e66031a26", "comment": "Malware payload (Mirai)", "value": "198717effc6c437b3bb61140c70ce1cb1131088d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768660284, "uuid": "0a665dd2-8d95-48a4-9813-a935cf556f0f", "comment": "Malware payload (Mirai)", "value": "0150e4b31a11161bbf5feb4fbb390ff8570bdbff564d847ba9c3779646bc1520fc1e57b6a0fab0726a64a253ccacdf70", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768660284, "uuid": "338f3065-d39b-478c-ac38-9da2ce7428fa", "value": "T17FA33985FA83C1F2D81704716062BB3FDB32D8958036CE5DEF9A9E35CA33941C6163A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768660284, "uuid": "20dd1e5a-a9c0-44d4-84d1-95e39217d2e1", "value": "1536:BkWTaH6cVENQrI36wjtgRjfBzeeBWQTCYYq5zk9tzECOUx+dx:BkWTnIQ6wjCj5udYYq5zkDOAK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768660284, "uuid": "1b21b8b7-3c82-4556-aa1d-44ef47719580", "value": 101448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768660284, "uuid": "a7704123-c6f6-4ac3-8b8d-f415c31b0f72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768660284, "uuid": "a70f0dbb-7fcc-4e1b-b73a-1e76b1b46676", "value": "ub8ehJSePAfc9FYqZIT6.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "475ce455-f3ce-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1768672773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768672773, "uuid": "1f69943d-614a-4e54-b30f-bbf563ec0e13", "comment": "Malware payload (AsyncRAT)", "value": "9b1fae27776d78962af062ded4a34a60", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768672773, "uuid": "4ad94d74-9149-4407-bfa3-37b7189f7022", "comment": "Malware payload (AsyncRAT)", "value": "c300943c88a0cae2eb609954b59c933b253c340f2997587830aee3d69adb7769", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768672773, "uuid": "6a7d081f-2429-4a1c-afff-b6ec65324656", "comment": "Malware payload (AsyncRAT)", "value": "a6440f66e1ca668dffdf767a5d9dffef1f05c510", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768672773, "uuid": "4460b16e-6fc4-4e62-a7b5-4297bac287a4", "comment": "Malware payload (AsyncRAT)", "value": "32a7f7b2fb2c3f604620109dab19dcb4a7c32c95e4d51e8b84992bc2f0d5e5994d741633a75ddd4e0352bad37d3b79c0", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768672773, "uuid": "267348fa-7175-4bff-902a-9fd35ea0b5c3", "value": "T188538D003BE8812BF2BD8F7899F265458A7AF5732503D64E1CC851D74B23BC69A126FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768672773, "uuid": "4b535844-e46e-4242-9d1f-f18b037d834b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768672773, "uuid": "1c77a62f-1ce2-40f3-8fb4-6274a018e59a", "value": "1536:Qu7cNTdjN2x3B3M3bHXKDYaxom3NdcQSqM6ZX3LsKS/vwaTipNa:Qu7oTdjN2xB3M3bHa3N3HLsKAXTipNa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768672773, "uuid": "c2139dcb-a85e-4031-bcb4-a7928d8333ce", "value": 66560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768672773, "uuid": "7d3aa31e-32b7-4448-8f25-2972b0233837", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768672773, "uuid": "350eae60-9c98-462e-b03e-f357aa347bf9", "value": "ChromeRemoteDesktop.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c0f5b51-f3ca-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768671143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671143, "uuid": "dbb087e7-e02f-4c09-b68b-a176ce2dd901", "comment": "Malware payload (Mirai)", "value": "6579140238f31c83fdb3f499d66ba8d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671143, "uuid": "5c17d6a0-fd55-41d2-965b-cf13b8718d90", "comment": "Malware payload (Mirai)", "value": "c39382a407abd50752e6c4fe8890394ef203bc24518b9b3d8789836afcc55289", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671143, "uuid": "9457e5c8-8f74-460b-8780-102508ce84d6", "comment": "Malware payload (Mirai)", "value": "c8c43606e2dca8cb0bafd5de772dfba32850c6ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671143, "uuid": "e756bf42-99eb-4a9f-8ede-d2489dac50fe", "comment": "Malware payload (Mirai)", "value": "7d60dc71501829719ea6e4838dedea8e1eff8d2ec484103b658cf46b41d6a281d1bc103b74b147f14caec7ba6b277e9e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671143, "uuid": "7cdce3f5-4b4d-4d72-8655-d9bf91640bea", "value": "T1D3934B45FC919A12C6D5137BFB2E228E372663A4E2DE3203DE156F22338659B0D7B741", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671143, "uuid": "821f44af-d854-42d0-b175-6f65d83b1ed7", "value": "1536:tOd4vdGhFbQFFKyELib8jPWL4nteyXffdqs8amv97w:tOd4vOFkvYzjPi4nNPb497w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768671143, "uuid": "f71199ac-00e0-48a1-a1e7-d0e0526515f1", "value": 92256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768671143, "uuid": "458de3f7-8aaf-4b60-8fb9-bd18e1aa3487", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671143, "uuid": "c0a949a7-031c-4569-91a3-8aadc669344b", "value": "windy.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc2f5002-f3b5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768662258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768662258, "uuid": "d175a278-316b-4265-9ac2-2997347c679f", "comment": "Malware payload (Mirai)", "value": "03d5b22b73cd180c8f41bde44bf8e915", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768662258, "uuid": "5aad0593-06cf-45d1-8601-528634866084", "comment": "Malware payload (Mirai)", "value": "c42250ad1509c514a4450f89e8e26237140fdbfa6eba5ec858c407506fac9a2c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768662258, "uuid": "1a9cd844-7747-4652-9f60-aa325bde8feb", "comment": "Malware payload (Mirai)", "value": "8c63643a6140bf04b20218627d38e594148df775", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768662258, "uuid": "9010c2f0-d25e-467c-93bc-4d491fe73282", "comment": "Malware payload (Mirai)", "value": "ffb789ab9009d0c644df3a3d972fb96a013448ba59b412bcf613f998a262e1e3a290dc4691cf8560d038b202b2c95943", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768662258, "uuid": "9507eb0e-db18-4f5b-bb62-3fab621307dd", "value": "T1AFA2D01572A32D56F3ED1C3DC96EC357B9A71BFC90F5327679401620C94920A3E39A4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768662258, "uuid": "d9f2b987-391d-46cb-8979-b0147cdf5143", "value": "384:vvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjU9hymdGUop5hM:vvQn4j+ZO5fKAlxKs3UozS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768662258, "uuid": "8086de5d-bc8e-4b88-bb97-d781ecbed3d5", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768662258, "uuid": "05a8c10f-7ad7-4f33-80f0-b7838ca07d4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768662258, "uuid": "f880623d-b1f3-43c2-958f-31c6025fb13f", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78070377-f377-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768635488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768635488, "uuid": "d46df870-2daa-4a6d-93cb-feab99c9393f", "comment": "Malware payload (Mirai)", "value": "772fa46bd18966cd2e6ea8add521e081", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768635488, "uuid": "d732b75a-1eb4-487c-82cd-02ab25bd9a83", "comment": "Malware payload (Mirai)", "value": "c4db60ad25020b35b573f02de1913a18d008b84c054ed56624056f8260be51e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768635488, "uuid": "84d7f3f0-1eba-4550-a2e2-2e6b187b0aa9", "comment": "Malware payload (Mirai)", "value": "ea58d94592af7535be164df6922da9720a06534d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768635488, "uuid": "db4584e7-bb83-41a1-afd0-0b329937cca5", "comment": "Malware payload (Mirai)", "value": "9994d22f6636587c7d475dabbdbdc394fc26d9bb84906bcc4e2265278be31acce547c41366ee05030cf5e5e98a217c2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768635488, "uuid": "b5e94aff-df7e-4f6d-a223-a79a8766d694", "value": "T104E3BFCFF2470495C42183F4268B2BED2AB72014AD2ED8F37C5E567F266E1DB0926B51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768635488, "uuid": "2e644b83-d655-4b8d-ae15-86918ca93a1f", "value": "1536:oQBb1if2lpT5jzf2OLyDV12ZlDvWOBnmWf6Kl8hx/GlhKIZofxCipgP/LWZDZ0A3:ZT53t7BnmixKhx/GWIZojgPqZDZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768635488, "uuid": "d5997cd5-1d2e-48eb-be2f-b72bba37c40f", "value": 154376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768635488, "uuid": "6b17b242-56f0-4327-9ec2-9f19b8188843", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768635488, "uuid": "b8cab425-90e1-48ff-bca7-d36a5ce0f0df", "value": "rondo.arc700", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "944ed247-f37b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768637254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768637254, "uuid": "1121ce3a-bb19-4a60-a7f9-392b34cac833", "comment": "Malware payload (Mirai)", "value": "26a7944c723d2b5fa860c2b162baec54", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768637254, "uuid": "19250361-4401-4c87-9a6e-fbc238485420", "comment": "Malware payload (Mirai)", "value": "c5e476b6ba5e6465f3114c422ca072f68f07ad56af1dfdb08612a6208a2274da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768637254, "uuid": "858d8d71-27ba-4d40-b747-51542f3b9fd5", "comment": "Malware payload (Mirai)", "value": "4467e552075b9b7d3191eaf571578c2b9f337ebb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768637254, "uuid": "19dd705e-8039-4fc5-b6c9-af88eccf1269", "comment": "Malware payload (Mirai)", "value": "f43ce89e585d43cfce6aeb659c09bd08a044469d0a021d91158059df7b63e19019cd06650e598474e80197f0652ab1e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768637254, "uuid": "a57e3354-7076-4cb2-8072-99befdef3058", "value": "T17DC35B42FA418F13C0D61779B6EF42493322A79593DB73069A249FB43F8679F0E63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768637254, "uuid": "572b5ee1-50f5-4105-80c3-d8579ca708b7", "value": "3072:cowpuQyNSG2eRa1styK9flTQPHoMrScVM/9OAvjik:cowpuQyNSG24a1styKdlTuIMrSmM/9nd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768637254, "uuid": "59dac2a2-3cd2-487e-9c1b-cbc3f06ef6db", "value": 129940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768637254, "uuid": "d9e84815-d96d-4531-a64c-d42c7a660993", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768637254, "uuid": "5ce16d75-8e86-4890-9d37-9592262060ce", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aba995a-f3aa-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768657209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657209, "uuid": "de0d6b90-c67a-478a-b189-5151eba3bcd1", "comment": "Malware payload", "value": "5edf6acf58264fab4eadac03abf205a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "windirautoupdates-top", "colour": "#5EA68C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657209, "uuid": "bd287c67-def5-40e6-a9fa-583aa5c98412", "comment": "Malware payload", "value": "c5e5bc79c3d8cb1cf4fb936dd37cc6df1cc5018ecb2ebee32fc8b6b69bee8243", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "windirautoupdates-top", "colour": "#5EA68C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657209, "uuid": "4403d8f1-2b8c-4eaf-b775-0f1b72473f70", "comment": "Malware payload", "value": "a7978eee61ac187bc9909be2ca8bd4cafaeee0a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "windirautoupdates-top", "colour": "#5EA68C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657209, "uuid": "924bd67d-f844-45ce-8b2c-5b777801e3ba", "comment": "Malware payload", "value": "30762d8fc41d9f79df203155853c9c9c794a09c7505ebf4ae216757888a5b4cd0b2e8509cec575cf4d52ba1795ccd943", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "windirautoupdates-top", "colour": "#5EA68C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657209, "uuid": "8ce089e3-8549-47be-8bf1-3107b78340a3", "value": "T14CE6338E5F2BE54BF9440B72A3B08FE10B9C5B26F64672DC9D97377A882B0D6C105853", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657209, "uuid": "76657384-f9cb-48c7-8721-36d8fecd5ece", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657209, "uuid": "09d49957-9d0c-40a9-983a-11d72526bdb4", "value": "393216:9gJMWX0/HtXDJyII4oRI5PLjy59H5GBCZalq5Aa1v4os:eGWX0vBDc4oe5jj4p5GBplq5Aad4o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768657209, "uuid": "0d1c61d9-c679-4ca7-bae0-90be9755f1a5", "value": 14712832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768657209, "uuid": "29b6714e-e69a-47db-87f8-6a7823ddbcd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657209, "uuid": "67a1a6c2-14eb-430b-b573-91ad87007201", "value": "Installer_v1894_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c646f66-f3e3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768681720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768681720, "uuid": "bb3bb245-1e4d-49fc-bd79-ce055392b426", "comment": "Malware payload (Mirai)", "value": "823efa9115fb9101b56dd3e5629aa0d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768681720, "uuid": "05201987-0320-42f9-b19c-2eef548622a5", "comment": "Malware payload (Mirai)", "value": "c71b9710d13d3152d370b46d22afda921cbe0815bbfc49eb703c6a0c739dc91f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768681720, "uuid": "116615e7-dcf4-44f5-891e-ede9416b2ba4", "comment": "Malware payload (Mirai)", "value": "0a83e0b3874b6595e0108ebd6fcc7a75895e462b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768681720, "uuid": "f3c1381e-8a02-4b30-99ef-d715a256c1d8", "comment": "Malware payload (Mirai)", "value": "3490ef1ae9cfe09228063f7074068f080799cc89f2979fe13c9b26feb9b21ee698bd27e0ce74761dc544f1df393b33ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768681720, "uuid": "a3dc1ca4-eaf9-41d1-9872-dcb9bf5310f8", "value": "T15243F122C2DBC50FD4EED6BC08CFECF6A408A96910E55CE6A9CD01B2B4E17587B186D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768681720, "uuid": "b0274f29-36b1-4a46-8334-c27786f043cb", "value": "1536:EnVUF0PD/NXVJBfxKOxC5qXGS/OYDtDnouy8tyi:+m2DBJx1x2qXZzt7outz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768681720, "uuid": "30658f7b-206c-4cea-918e-f0db220a3a60", "value": 56180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768681720, "uuid": "7193cbb9-e653-4172-a847-5e1d6591be6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768681720, "uuid": "2037503a-9e98-432b-a3ee-d84386d59b40", "value": "Polar.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68275f2d-f3cb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768671539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671539, "uuid": "11b9bf86-cad5-47b6-93dd-05fd7068e2ee", "comment": "Malware payload (Mirai)", "value": "36b8f296d281661c3ba8036c2a263381", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671539, "uuid": "74c09a07-b94b-4b88-bdd5-31363424f6c5", "comment": "Malware payload (Mirai)", "value": "c774eef0f6126970cc0183d4687eec8be7b7f06c1d7e54f6f223b5bb963bf57f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671539, "uuid": "e16566b7-b83c-420a-b5cc-93cf44ef5772", "comment": "Malware payload (Mirai)", "value": "c43e8877937840f0401cf7c0e52058f905950965", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671539, "uuid": "c278e0bc-8493-4579-91c4-1278a00d6999", "comment": "Malware payload (Mirai)", "value": "0e86386433fd8f06e78f8933d397c827679d0b34a226b48ccfccd347d198583875f6274ed24e4a22c9a7282af85ff542", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671539, "uuid": "79ef716a-ea5f-42d3-9eaa-27fa4eea8157", "value": "T188B32A46FC818B61C5D612BAFA1D318E331377B8E3DE32129E145F25738A5AB0E7B605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671539, "uuid": "00e3c4b1-d78d-4571-a372-fc9359ffcb8e", "value": "1536:ZwnBI556P45jfn5pTTCqG6YGmiW4gMVtCakSQTXcEDQi2FY2cjWh7Yp5Hg3ajYW3:gIWmq66T4RVtCakm3FY2cjmkpi0L3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768671539, "uuid": "8df7306e-9790-4cfd-9fcc-3653688ed225", "value": 112108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768671539, "uuid": "01280ac2-8c0b-4b78-9ba5-e8062f4adf7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671539, "uuid": "3b745fa2-128b-46b8-87c4-ab7b4a34a71a", "value": "windy.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ca68310-f3c9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768670634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768670634, "uuid": "a142cb35-ae54-4cb5-8f99-e6d329e2532f", "comment": "Malware payload (Mirai)", "value": "1db5c5dee42dd466e2b459730d8b0e64", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768670634, "uuid": "ddce5ae3-fb63-42ff-a4e1-46cd72870068", "comment": "Malware payload (Mirai)", "value": "c80c6228ca08007ae6de2fadd86fc12aa75f2f1c96eb3c2e429da1cef3fedffa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768670634, "uuid": "a1d1f4c6-768d-442a-bd72-3bd59738255c", "comment": "Malware payload (Mirai)", "value": "acc3e89669a12d611eecbf55f7c3b97ca8abd1f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768670634, "uuid": "ef2a92da-6912-4f3c-8379-6ae8cebd4724", "comment": "Malware payload (Mirai)", "value": "b2f3d1a5a2393a7da6ccce7e881b17fbd0dc47766e5c0dd4d76686f079c13281bffa4c567dca44ddbc2791c75144c73f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768670634, "uuid": "05007bb0-7fa5-4394-a592-1a614a5006e6", "value": "T117E35C46EA818F13C4D5177AB9AF02893332A75493DB73069D186FB43FC6A6F0E63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768670634, "uuid": "35c5e98e-1a4f-4674-8118-428f0d19f907", "value": "3072:aJw9JAFjd/McSi9mJOTW6X72gM0liUoNEWztr3FckiD8SLOfM/9oFLxh:aJw9JAFjd/McNmJOC6XOrEWztr3KkLSs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768670634, "uuid": "0ae014f8-581b-4165-b0c5-a4b84e45d4b3", "value": 146259, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768670634, "uuid": "f50a6f16-9208-4b8f-989e-c8d437398528", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768670634, "uuid": "c1095812-5202-44f7-b448-8d5163fcb1e5", "value": "vcimanagement.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a0945d3-f3d5-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1768675811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768675811, "uuid": "49482eb4-1cce-4dd5-883b-cc37361c7e83", "comment": "Malware payload (ValleyRAT)", "value": "18d53d4e3dd13666a369eb7d7f585a03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768675811, "uuid": "f9191aa1-fb4a-4c0f-a2d4-8de737e377ba", "comment": "Malware payload (ValleyRAT)", "value": "c83673fde74eaa3f8d851f6b16f492982db64708202f43147d0672ba86655217", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768675811, "uuid": "a989e309-9183-4c2f-96e4-345df2f8c051", "comment": "Malware payload (ValleyRAT)", "value": "f92a6df9c27434082d17283ca13e6a5625941ada", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768675811, "uuid": "39698410-6fc9-496a-a75c-f7393b2f7615", "comment": "Malware payload (ValleyRAT)", "value": "34ac492a8bea66ef1bbffc5d2e191bedb104b546ca36955f3d470319b61ca9b7a785ddc2fe4dd202e0b5716ea5c2b845", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768675811, "uuid": "77794fa7-c4d8-4424-abde-9b09c07e9448", "value": "T1ACD5334A104241F5F5A31C38DDE7FADE39B131A408B18D6E6ECA3CC7A9B3C65646D12E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768675811, "uuid": "b4667484-ec97-49bb-b2c9-c0cc465b40fe", "value": "c12366bc928423da75a87d5e3461c7b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768675811, "uuid": "40f6d6d9-fbae-4d1e-8ee9-093fb36f7d08", "value": "49152:Y0A0GqBFWP7jOu4mgDRMTPUyvkAkyL54yYBoauRSyYkDElZ3j3O7yRBzW1aVDNf:CGNDRMTUdAJDLsKADT+ABS1a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768675811, "uuid": "f6c5c3e1-54e2-4109-ab53-3b5722009767", "value": 2944000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768675811, "uuid": "297e7a21-0a8c-4cfb-86c4-d701b0fb5741", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768675811, "uuid": "1f2384e4-f387-4823-8d29-07931f628e49", "value": "18D53D4E3DD13666A369EB7D7F585A03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cde69658-f37e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768638639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768638639, "uuid": "29b90670-00bf-450a-949a-ac199a828a72", "comment": "Malware payload", "value": "842bdb3edc806ce90f51edabb949425c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768638639, "uuid": "29d9e2d9-0c78-444d-b069-9333531fad1d", "comment": "Malware payload", "value": "c8fda41597e5e231bc8c65dcdfd38f8d96b035349360b2c13f248a1dfbc361a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768638639, "uuid": "6b19cd04-f1e7-4f4c-a075-5c91aee93b6d", "comment": "Malware payload", "value": "f1c8396b24ab7cfe2c73ad95d57653736c562f1b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768638639, "uuid": "b16b347c-3409-4c11-897c-cfc49470e126", "comment": "Malware payload", "value": "29f91f241290b39c7b4841e63d486dac5475884eeea98c52b15f226587da866811ecbad086f6e808e763c63003883b7c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768638639, "uuid": "ee753dda-5dff-415d-bfd9-9e64bb534e6f", "value": "T17FE18117E2E2CD32D8D0137E45930A1A223DC8659E83DF132E0C896D2E537DCBA72B56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768638639, "uuid": "63645ad8-cdb5-41fa-a0dc-432c73fe457c", "value": "96:f6u6TiUBOUw3TJheuhiU5Zz/cq/BK+M3mh/W785/f7kbalBgBi5pzBIQ:fEcbDJhA6Zz/cl+M2x/fLbpziQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768638639, "uuid": "b2234a55-f2d5-4551-816e-3b5496063f22", "value": 6968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768638639, "uuid": "d08540c2-ef63-4dfe-8352-782e8c1d39d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768638639, "uuid": "6687d4e3-dedf-4cd6-98e6-dc92c0f52ab1", "value": "SecuriteInfo.com.Linux.DownLoader.2312.10959.27288", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "989aa20f-f3da-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768678063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768678063, "uuid": "b7739a3e-055e-43da-82a3-5d2c2a7de3a0", "comment": "Malware payload (Mirai)", "value": "657ac26477066fc73c3e40f4dcb1885a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768678063, "uuid": "79b03641-b3d8-4135-ba21-886cece9441d", "comment": "Malware payload (Mirai)", "value": "cab834a3eaded326daf98f42cc4deda6e27c3c2422c3a16fd3edfb5b8a16438e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768678063, "uuid": "2c0ed19d-19aa-41da-8b71-095a3238fb7e", "comment": "Malware payload (Mirai)", "value": "3ae0f9d9b6f6f32cd21019a64337a482456d4975", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768678063, "uuid": "34aa7ee9-ca5c-4fb4-8f6c-ebd6794a3e3b", "comment": "Malware payload (Mirai)", "value": "561b4a5698ee35bedd38c8bd0e562365ea8c9a53e7f007773d98c6a7424b69812889000fbf6b68af7bdb29e97e09b838", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768678063, "uuid": "90547fa4-2921-4b19-9cb5-1d96132cc381", "value": "T18524A64E6F318F7DF7A886344BB74A20975D23D622E1D585D1ACD2115F2028E682FFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768678063, "uuid": "a4cf11b0-0071-48f1-8676-dc6352fe5f05", "value": "6144:Dm5865ttFLruRxAYlsmhgD+8u+UKECnl2aCX:a5BuRxAhDUtX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768678063, "uuid": "ddb6e882-7959-4941-aad4-b093f8238041", "value": 229384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768678063, "uuid": "36095302-b7d2-4cf4-b606-54978bfff96d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768678063, "uuid": "510a0dde-42a7-4d89-992e-6437846fbaa6", "value": "Polar.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37c3124b-f341-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768612188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612188, "uuid": "ccbb7b1e-00d9-4626-9452-604194bea5f2", "comment": "Malware payload (Mirai)", "value": "52ce8a8e5115a743036a59d7f307670e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612188, "uuid": "4d4d5bb1-e5e5-443f-88b7-5b90cf50e5b0", "comment": "Malware payload (Mirai)", "value": "ccd10f047dab13660c01c7fa33e5538d4cdf93058a674d933c62166d91d44d79", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612188, "uuid": "3947a8e0-a303-4a24-8a85-7bdab9975262", "comment": "Malware payload (Mirai)", "value": "82fd75ea61c619039fc6fd9ee45e750b5803a8ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612188, "uuid": "9becb082-1d1b-40bb-b0be-906fc6608a07", "comment": "Malware payload (Mirai)", "value": "1a400b78197172074578fc886a60ff7aa0052ceb0614d20ad511b9763efb8cf868ddb15fc7533e139b1de55f099c7020", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768612188, "uuid": "8aa727d8-37b7-4f77-9086-bc4f4b60e3c2", "value": "T1CC336C36E029DED0C6560234A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768612188, "uuid": "fb80ce63-7a37-4629-ab8f-d9a33ca94c4c", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768612188, "uuid": "af9e7258-bd2c-48c8-b5bf-fce7ecc5319f", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768612188, "uuid": "8a696d70-28f0-4668-9979-e778590be411", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768612188, "uuid": "5f4a6624-45c1-408d-a0c7-2c7b315eaefa", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f537f31a-f3ca-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768671347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671347, "uuid": "1df1bbb0-2ee1-4799-80e7-502c2cf75394", "comment": "Malware payload (Mirai)", "value": "801daa318d75b522554c9dcf404a8e1d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671347, "uuid": "0ddcf5aa-8c19-4189-baa6-85e61bca6901", "comment": "Malware payload (Mirai)", "value": "ce2cb59ad460ac9f29a421caac7dd9d5587d7b6cf456728f84da43f5493a87d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671347, "uuid": "7e39f70f-2ffc-4bd2-a872-c856dc3f7f6e", "comment": "Malware payload (Mirai)", "value": "8348833c28a9dd9a5bbbe13e34f0dd46cdadb207", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671347, "uuid": "f6f1e8ae-4ff4-4a97-8392-78c561fca85a", "comment": "Malware payload (Mirai)", "value": "b9b17b187532a7455b955ea4628fb9a11b41fcf875179d9b381395eee1ffa40be6ab0462d2d599f2289d6ab88d37e84e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671347, "uuid": "a67acf11-561b-481c-9479-6a18898c1dcc", "value": "T16D23F18917C6C841F6F699B7BBEC8307D66DC3F8E56623D3217049F892C3A2585B444E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671347, "uuid": "169aafdf-d09d-412f-9af2-b2b1db595624", "value": "768:dN/EIBpx5nwl2vQR6Yp3e1D3y7xYx5ItJ3zwWCEsVdyc6JmU3s3UozDZ:nPwmQ0tVUxAItxcwpcuQzDZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768671347, "uuid": "22dde2fc-e3c1-43d4-9ffa-7cc15c4a1fcd", "value": 46844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768671347, "uuid": "7161fcee-1e14-4662-a3b0-fe0e55d298e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671347, "uuid": "76df1528-3aa3-4206-9717-65ea464bc582", "value": "windy.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79e92a74-f3ca-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768671140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671140, "uuid": "dc70bc94-d1b1-481b-b169-b142bb1d4a32", "comment": "Malware payload (Mirai)", "value": "f633d7f63061522e71ebebd650100676", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671140, "uuid": "675a0b09-44a2-4317-981c-68376b662985", "comment": "Malware payload (Mirai)", "value": "ced9efaf54674ddc46e934db3f297f9491c8880718745cd451394ee1e74d6d94", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671140, "uuid": "1526c995-674e-468d-a1bb-ae6717fb57bc", "comment": "Malware payload (Mirai)", "value": "2936d525d822118e26ac55ffe214b983388ceea6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671140, "uuid": "0c8bb02d-3125-459b-895d-85b7d327e39b", "comment": "Malware payload (Mirai)", "value": "d0cb9b4a1f7c9c782e4b6b03e988473ce90f61ce51eb349f0ec99fa59faa01ee8d8f7a1d6181d7c44923922811bbbf5c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671140, "uuid": "b5b4818e-649c-4b72-ab14-1b3c93184d13", "value": "T12A834A02B3480D43D1A71EF02A3F37E593AFD59121F4FA89650E9B4A41B5EF2254AFC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671140, "uuid": "710e2c7a-59d1-4b46-a164-dda698f4d9bc", "value": "1536:P1C0/rWu3QezqNZxpsOKFC+Qma+4a619tH4p:P1C0L3fqJeF4mn6x4p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768671140, "uuid": "7a18a35d-bccd-4af5-9872-8d9e9677a255", "value": 87744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768671140, "uuid": "6e35b6da-7c0d-488e-8ec3-479783216700", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671140, "uuid": "a008c6a3-2dcf-4bc8-b788-e535b2b9ba93", "value": "windy.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3865cf63-f341-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768612189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612189, "uuid": "ba3bbfca-8f76-4fcb-9ab4-b8bd7ffa4a45", "comment": "Malware payload (Mirai)", "value": "9af93612cd42589af4839978089965a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612189, "uuid": "314097eb-15d0-4ee1-959b-28c52c6c09c8", "comment": "Malware payload (Mirai)", "value": "cee2e50b5700448a22b95cb53b9ca050ab2e5af203cb063d113a3f676722bfc6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612189, "uuid": "65e9a0e3-ff31-40bd-a945-f5fd1a98b626", "comment": "Malware payload (Mirai)", "value": "2b2535219dab6e974e71002734bc5fd4a17f9502", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612189, "uuid": "05852ab6-6303-435a-88b6-a79d4d4e353e", "comment": "Malware payload (Mirai)", "value": "6e18e3fcbccdb8112201af65642de2bb6a237e8cbec366d4f4751c3a0a8aec92992e9bdf62da8cf3689af709a0280733", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768612189, "uuid": "a8e9aba4-0dc8-4b1a-91b9-3f9d3982a0a5", "value": "T1A2B2C0CD61943084CA8D7C7C57CD4A664F6CA0D0BAEE9B16E350CD98B3BEA4F3459078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768612189, "uuid": "c2ce90a1-c159-484d-9f58-a1574cc98ee5", "value": "768:oCrQlS07dEv0UXqUhvQE+CXQKMQKCXBpyZqEWvc:/QlS07FUXqIYSXQKquWqW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768612189, "uuid": "e3331a07-67ae-4afb-92fb-23d303d1bc61", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768612189, "uuid": "96b3fc13-5e90-4a33-8d6b-659a795f188e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768612189, "uuid": "43ec8fab-6d80-40a6-8828-114636aa7967", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92fa0649-f3a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768655290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768655290, "uuid": "4e1b845b-1339-4c6b-b88b-77c8ee6182c6", "comment": "Malware payload (Mirai)", "value": "b532e179dba5954d7cc4a4b653aeef56", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768655290, "uuid": "220951c3-e791-4d82-b477-72007599b69c", "comment": "Malware payload (Mirai)", "value": "cf30aa6081829662902fea9fb3455d453e30d4b55088b3a6fc091628950a3aa4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768655290, "uuid": "0b19cafb-bd50-4375-97da-d360a87825ab", "comment": "Malware payload (Mirai)", "value": "788b8bc72ffb5d48d94b528ee7ddbb04ce6cd81c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768655290, "uuid": "5f5e920f-b8ed-4945-a7b6-3d7acc90162e", "comment": "Malware payload (Mirai)", "value": "39c22a2263252bf5940937f62c153a443cf6a9e0dc97693c070700c263e94ab4dd70463bb0062603f4fc60b23f7e37f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768655290, "uuid": "2edd2516-a23d-4445-b8db-c397d1074154", "value": "T17023F135A9C8239ADDFE9172DCDEC5C473308F9C266888915385FF06193BC32858EA95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768655290, "uuid": "1c13f788-15a1-48d4-8d1f-13a6b2c01db9", "value": "1536:a5+QswVWUwfgEBpLSbdLvMyB4u+qgw09M:aICEpfgE3Oh0+4u+qgwV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768655290, "uuid": "c5e7f1a1-8ea2-466c-8dc6-482987f81227", "value": 49284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768655290, "uuid": "050c8f73-11a7-4b3e-90b8-10da3e69af79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768655290, "uuid": "4361b4d5-cd16-4246-af77-3bfe36332302", "value": "ub8ehJSePAfc9FYqZIT6.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63991bf4-f34d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768617415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768617415, "uuid": "ebee0d03-211a-4785-9469-31eb6c08c27f", "comment": "Malware payload", "value": "2a02ab24059cc42bab1d4abcab294a02", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768617415, "uuid": "c362bf71-0f34-46b2-817c-80d163873642", "comment": "Malware payload", "value": "cfe5007c67bc42dd8bdfdcf6bdbdc568714726c31766bd8ba9f1dc74f5962317", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768617415, "uuid": "18c309bf-cde9-4e31-80f0-c40bca5e7696", "comment": "Malware payload", "value": "94fcad5c9b993750d74065917b78deb1f49f76ce", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768617415, "uuid": "f2f8a894-19ff-4a33-a494-2579fbbbc8df", "comment": "Malware payload", "value": "b891a625d6d5db9e3d9741e63009535ae787e29e819db56a961474b0b92632f6176866903021a4d36d44c227b86bb93b", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768617415, "uuid": "b8c152b4-9e35-4bfe-9737-a102d2e1793d", "value": "T1E2E02005ED3DD5565D5BCB6A50F2C81C85E7B70C2220D1115AA8CAAAF5085B84E7B642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768617415, "uuid": "f4db5320-3286-4cf2-b192-d5e226167936", "value": "6:ZDVahmKq9NqhLy+7yQ7ARkbnIvFIYAGQO0cR9R3KLaxTlWS+WOaAc:amKqahz/ARkbnItIYAHpcR9kmTlX+WOg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768617415, "uuid": "a43668b5-a911-4c71-b9ba-a9cdece7d500", "value": 370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768617415, "uuid": "07899bcd-781f-49dd-af8d-6a216dff9b36", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768617415, "uuid": "66217ef1-fb3f-4a1a-8400-ea44112bf19e", "value": "Foxtrot_piece26.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ff1698a-f3b2-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1768660815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768660815, "uuid": "11528281-3685-4dff-b9f5-2e779bfa07eb", "comment": "Malware payload (Vidar)", "value": "b68a057cf367d7fb0dbcd54462b62eb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768660815, "uuid": "fd6ea8b1-a2a0-498e-af60-ae7f8a72a938", "comment": "Malware payload (Vidar)", "value": "d066d70add7144775dec1e2bfaa5b7404f96e35852cdca6d8d28c45400b79426", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768660815, "uuid": "7b33510d-e58c-43f9-b0cf-8032e0953780", "comment": "Malware payload (Vidar)", "value": "70ff7dd9377010c8f231ae64741cfd916bddc475", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768660815, "uuid": "34d677de-603b-4e6c-9469-4fee99d1be37", "comment": "Malware payload (Vidar)", "value": "49c139fae927a989402415a4cf2065dc4b23b19eb84b49c2579b82114bd895f6d5ab1b420361ec82c301ef151a0cfa50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768660815, "uuid": "9f608c33-78a5-447a-9317-8bdcac347801", "value": "T176866DE2BE104776DADBF236E4A162852230F144073505D7BB9917A6486BBC8173FB2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768660815, "uuid": "36b4a591-85f0-46a0-9b86-fe6394de4d8c", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768660815, "uuid": "b21182c1-39e5-485b-984c-2df4f9058c00", "value": "49152:++2ik+Irb/TFvO90d7HjmAFd4A64nsfJC8TapGnGrA0T2GayeBrnfMgNA1IF6gbS:zDXx4TH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768660815, "uuid": "7ce852e8-43ea-499f-9ca5-d8dff106b5e2", "value": 8519808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768660815, "uuid": "4df1882a-75c4-43a9-9193-3b2028764855", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768660815, "uuid": "47acd041-2327-410c-a833-cbe9e19c193e", "value": "activate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "183ac302-f3a9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768656803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768656803, "uuid": "b6ae7706-a3ba-46ed-8395-f70abd0c0ae2", "comment": "Malware payload (Mirai)", "value": "c26090b04a73a4d55f8ebd363e0396b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768656803, "uuid": "cbf6e06d-59b7-4845-9fe2-5db57874ed20", "comment": "Malware payload (Mirai)", "value": "d0a71d1e228668c6d7bffbbb98b17d24c448634a64274e1c460477968d835bf7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768656803, "uuid": "e1eb588f-eb83-4acd-9086-5f55ca816576", "comment": "Malware payload (Mirai)", "value": "edc94e3b3d34f09da8e42b093049c886ba03444f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768656803, "uuid": "892f685e-db56-47e1-a160-cd8e7f0d1784", "comment": "Malware payload (Mirai)", "value": "f0119a55f29507f745a3e6650f92157bd72cbc97d3d206ff3f27f835f7e69a0d108f73aad2bddb848b6390534238dffe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768656803, "uuid": "11cb258d-ae4e-4510-9e3b-05f94d66ea1a", "value": "T19403F146F9C9EB70C2BE60BA05BD3B5F0A7F521E65E780B97D8530739A0910F6114AF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768656803, "uuid": "4f03879a-bc96-485c-a231-48bc4a5c9366", "value": "768:PJ/NwEfDzRmDSP6VhdKR8WbUubqbDCoAIBL1hJtCMHzDVJ7R6PQK/BJnbcuyD7UR:hHrU4chdW8WbNboAIBLrJcMHz/7RXQnf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768656803, "uuid": "25bf5b5f-173a-48ac-a6d0-ed5686228599", "value": 40360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768656803, "uuid": "e3ea6d0d-934e-4a37-9486-61bea77a68a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768656803, "uuid": "7453dd55-d319-4612-9a2f-b80f3f7bd0ac", "value": "ub8ehJSePAfc9FYqZIT6.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71105ca2-f3aa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768657381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657381, "uuid": "dfed78be-df7b-4e3b-be14-7ce2d10a2a78", "comment": "Malware payload (Mirai)", "value": "9015dcef5737046ea6f187951ff1f9fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657381, "uuid": "a3a1bfc3-0d80-401b-9d47-c48d3754e1ca", "comment": "Malware payload (Mirai)", "value": "d4409d71a30560aab06a68cf5d42bc757eda58741d8cc246ff1eeddad13e494c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657381, "uuid": "e9bda75f-60fa-4b43-82db-78077643b3bc", "comment": "Malware payload (Mirai)", "value": "435a62a94f8817238d49082607c5720d902ab359", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657381, "uuid": "8aea637c-ee84-4bfe-91da-2cfc1199ef43", "comment": "Malware payload (Mirai)", "value": "45ea85d2c16ed7fc587c5e42e273bf01e62b8ac04e769fc29f369866fec706d216a086b99887b4bd24e486414db7bb2c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657381, "uuid": "4cac23ed-0ab3-4e5e-9059-d6b997f18b3b", "value": "T1ACF33B46E7418A13C4D61B76BADF82053323AB64A3E733069D28BFF43F867990E67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657381, "uuid": "561801f6-d218-4990-b398-692188470bc1", "value": "3072:zu52DbsL+f3anhoGqgBirU6ozqAI6MKKhUdM/9KmUw8qn8y7:zu52D4L23anhoGqwijQqF6MKKh8M/9KS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768657381, "uuid": "e015d8c8-c022-427f-946a-d04b985f3a33", "value": 163477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768657381, "uuid": "b203927e-9fdb-4273-9ceb-e7ab363e2ed0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657381, "uuid": "893ca6ff-070c-435d-9131-415ea2219339", "value": "ub8ehJSePAfc9FYqZIT6.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77948fc0-f3ad-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Techsnab)", "timestamp": 1768658680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768658680, "uuid": "cec5490f-9471-438c-bddb-ec4c52777fd5", "comment": "Malware payload (Adware.Techsnab)", "value": "9e739c1b92fde6ede7642e02946d1384", "object_relation": "md5", "Tag": [ { "name": "carlessclapped-com", "colour": "#43D115", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768658680, "uuid": "b53c2555-a4ce-41c6-912e-82dc1ac5107c", "comment": "Malware payload (Adware.Techsnab)", "value": "d7244f14574ed60eebddab927f4cf082842ca17d31affb418ef1e413a5c8a6af", "object_relation": "sha256", "Tag": [ { "name": "carlessclapped-com", "colour": "#43D115", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768658680, "uuid": "90f40f6f-480e-4d21-87be-3803cd23e99f", "comment": "Malware payload (Adware.Techsnab)", "value": "8571c282615d6311eb45698bd13880d3110f7c0e", "object_relation": "sha1", "Tag": [ { "name": "carlessclapped-com", "colour": "#43D115", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768658680, "uuid": "0121585b-de26-4386-91bf-22ff48d1c221", "comment": "Malware payload (Adware.Techsnab)", "value": "02853ed6fa52b98223d41baab0611aba18b63dfd29b8e31c7f9b8396713fd6a48863d7f5e0cefbb352a5e47625ec615d", "object_relation": "sha3-384", "Tag": [ { "name": "carlessclapped-com", "colour": "#43D115", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768658680, "uuid": "d312b63e-be46-427b-9242-8160ede8c974", "value": "T105756CC29FC7DD53E3A153CBEA53FA5CE878945F4763E4C871C9B09C2268A9422D482D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768658680, "uuid": "36dc00a2-393f-4e7c-bc62-157c2ea55814", "value": "12288:JtevyTNHGGHNY7Cjjuh/eMVb5rKsH5E0J9Q1oCyDVAzg/RXx+ZscdbbPWvEJRHY+:dFGGtYgj6ecbosZTJsoCyDVjJVOF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768658680, "uuid": "8c0f3d2d-7423-419c-96a9-ecb3185b4092", "value": 1641215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768658680, "uuid": "4ff0b9f3-0e3a-4340-b3d9-7fecff58e52d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768658680, "uuid": "88b16e6b-3791-4c5a-aa99-df4a966c54ec", "value": "wgdbgcz.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7ed2d1e-f34b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768616725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768616725, "uuid": "8df31aad-a50f-499f-879a-25cde137aa22", "comment": "Malware payload", "value": "dcba89a7f4fbaee457a6a33e61dfe5e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768616725, "uuid": "f56a9495-105d-4eef-a5c3-166456cd24f4", "comment": "Malware payload", "value": "d85b8ef555d78e1c119e16f4c6b7e497879c89cd179b3d3a056597bc068d1e1d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768616725, "uuid": "d9869a50-0055-42f8-8856-7639e0cc9287", "comment": "Malware payload", "value": "cf8aa2a3cd3e2582f27e3f9ab7cc9184008ac638", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768616725, "uuid": "ef1a50c1-ba09-49b3-a00b-e607c2ae758c", "comment": "Malware payload", "value": "020e633ecd314f777f6f00bb36b73169ccfa1176df4392634dc46e9b15e0362920912d234049e9528507eab7b7b3b30c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768616725, "uuid": "a551cbb5-59d9-4e1f-ad79-230cbf57ddc8", "value": "T1EFC31A44B982C0F5DC0B4973A45BB73FCB30E57A92269A44EFA84F65DB63A4257073C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768616725, "uuid": "2626c88e-be6c-4cad-9891-f5240d420139", "value": "3072:FstaGndMkfZezYqd7Gbc21DEoS5qG689pi9j:OtaMM/daY2Jcp+j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768616725, "uuid": "bb83758e-9583-4843-af93-ae0a4800b29f", "value": 124388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768616725, "uuid": "8fc0dd79-288c-48fb-acae-7136b84f4c1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768616725, "uuid": "df6cd0ce-cf1f-461e-bc7f-6792be8a7d12", "value": "rondo.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a410733-f3ad-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768658604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768658604, "uuid": "000b9696-4c12-4c21-a874-0aaca1c01e0d", "comment": "Malware payload", "value": "9f6b2be6256f2e4991227424e13afcc4", "object_relation": "md5", "Tag": [ { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "fileless-market-cc", "colour": "#2213A0", "exportable": true, "hide_tag": false }, { "name": "OrphanHTA", "colour": "#E83ED7", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768658604, "uuid": "00860b53-a0f5-4128-a482-c89a20de0b0a", "comment": "Malware payload", "value": "d8a60145d2655ac62c2e46ccdbc9e48566639759e6d5062c44744ce3e2c8b1a0", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "fileless-market-cc", "colour": "#2213A0", "exportable": true, "hide_tag": false }, { "name": "OrphanHTA", "colour": "#E83ED7", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768658604, "uuid": "f968e244-8f9a-4029-9673-d498f2e61fe7", "comment": "Malware payload", "value": "842a814a1681d93fbe08155bf96144aa852d579b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "fileless-market-cc", "colour": "#2213A0", "exportable": true, "hide_tag": false }, { "name": "OrphanHTA", "colour": "#E83ED7", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768658604, "uuid": "36fde82d-3d13-4bb1-be32-bc5978acd8b5", "comment": "Malware payload", "value": "0cdd347aac9b03c76abca57759f987f6793003dd87a0ab96bbab99fd13b0b8a4e9dc700a510e983872f48689e6fa608b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "fileless-market-cc", "colour": "#2213A0", "exportable": true, "hide_tag": false }, { "name": "OrphanHTA", "colour": "#E83ED7", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768658604, "uuid": "6ebcee3f-d848-4d39-bda2-0c01d5b967fb", "value": "T1D6B15327ED875C538292DB93D6D7D21CBE7998DD90078AC5F9ACC182A9A0C390B19E1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768658604, "uuid": "fd73f44f-27f8-47d5-8583-61aad840290a", "value": "96:6NHaOWC7hICrvIug5emOEA7Dl+I8IEqNgmS7OoEmdj2crqM:KHaMN4fOEwzMOoN2M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768658604, "uuid": "4bef8be8-121b-4d39-b39f-448831a08499", "value": 5236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768658604, "uuid": "ece1a8c9-f9f0-445e-96e8-7ee366e471ba", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768658604, "uuid": "4e3dbc43-43c5-4281-9e07-a825ce608596", "value": "Notes.pdf.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7837cdb-f3b5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768662277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768662277, "uuid": "72246262-e358-4922-b528-bef85b842754", "comment": "Malware payload (Mirai)", "value": "7dec19175b04d786fa024e924567d055", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768662277, "uuid": "179bed66-2e86-49f8-b4e7-fbbc3e466206", "comment": "Malware payload (Mirai)", "value": "d8b0e72d3ffda641dcdb074212cfc2c56da77bd28a350a1970913f1cc74852e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768662277, "uuid": "6cd61443-e0e0-4642-b3c7-1724a8a8b628", "comment": "Malware payload (Mirai)", "value": "71f9e8f6b576cd17cde16c8d07a62e858ee4203e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768662277, "uuid": "4d8d83bf-711a-43b7-9a36-70c5d04066a3", "comment": "Malware payload (Mirai)", "value": "a5abb3513639368d5c1a84b3f20248afa77b3553873087490a37593f4cb9cd59877d2a977caace7f169ea83cb036e578", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768662277, "uuid": "7c930d60-602e-4ce5-a325-b5ac491b5f34", "value": "T1A7431891BC819A23C5D4137AF56E56CD372133E8E2CF72179E214F613AC682F0C6AE95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768662277, "uuid": "491b4a8c-7f43-465c-9df9-7f2d33fa9622", "value": "768:raehM993TLSmRTIrL8Fvvhp9H0HrZQ8yoWXagcLVPWtuQ/C71mA2EDEy0eYjW9TF:/M99jmL8BZp9IFUoWKdYuvQ5KIqkypZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768662277, "uuid": "c924a338-a4d6-401e-8f6d-1e09beee6646", "value": 56160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768662277, "uuid": "cf553261-3409-49c4-b208-b2597e6e6111", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768662277, "uuid": "5530865b-4bd8-4ed0-a46b-98d1fa8cceda", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5f820e0-f3ca-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768671348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671348, "uuid": "fa13ed3f-e9fa-49c5-8316-1a1d024f83c0", "comment": "Malware payload (Mirai)", "value": "b9bc21a2cdba826fab943d4cdbff62e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671348, "uuid": "2e9c4a2c-e85f-4567-81d7-57df01e8bcef", "comment": "Malware payload (Mirai)", "value": "dad77898aff9a551d1796bb4f5d64cb76eed1717048c7ec3fccb04bbda7bff34", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671348, "uuid": "2df981ec-291e-441f-8fa9-81b7be981b17", "comment": "Malware payload (Mirai)", "value": "824db3909f1e4baccde78d4a98e259f77b74e3a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671348, "uuid": "f2a5af8b-62d5-4331-98f5-acbe310a5f3f", "comment": "Malware payload (Mirai)", "value": "7e467507783dbb73211c737f9880e401435ad2c78ec40cd81989561a4c2f03d015025f85e087bd8b0463692cffb45ef6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671348, "uuid": "1e77f53f-5f46-4e2c-bf40-45022657a638", "value": "T1B413F1A4D9C68FC6DAFEEAB86FF180E213B20EC7B3955CD115C593816E1C815B344A84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671348, "uuid": "8344fb81-c3dd-42be-9b4a-0f2e9bc8a7be", "value": "768:CRlNQ64jd+AFD2OiXGHt0svv+rxICvEv7gDdL7TyfPVf3baTVK4uVcqgw09G:qY3FaOmGHOMv3kEvGdPe9rahK4u+qgwz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768671348, "uuid": "b2045381-f018-4264-a497-014ba6c3d213", "value": 45420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768671348, "uuid": "18fe2409-5a37-4c63-804c-ab08e1d72740", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671348, "uuid": "4948a4ea-8b37-422c-b68a-e0c8137136f1", "value": "windy.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "767d3f11-f3ca-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768671134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671134, "uuid": "08ce53c2-2ac2-44d9-bf0f-c01724509982", "comment": "Malware payload (Mirai)", "value": "3007ec63d3968bd2f110ab22ffc692cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671134, "uuid": "fec099c8-db72-46e3-8ace-fa6992e3356d", "comment": "Malware payload (Mirai)", "value": "daf7dfb7b65b95df4a4afdc4ab4175e6a5359c42d260a69a124cdd49ff3e2b14", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671134, "uuid": "675069b2-e995-4dc3-8a5b-3c1d952d6bfb", "comment": "Malware payload (Mirai)", "value": "7080ca2847d8c29af74ee917d274d3a4828f301a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671134, "uuid": "08757e11-922f-47e6-9dba-6160c3f9c39d", "comment": "Malware payload (Mirai)", "value": "862b6140d09ccfa00767491bf18d7c9636f09a56520da2bcc5ce920305259d70356b50045561cbf9f77398fc2e948257", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671134, "uuid": "3ad6b25b-d262-4375-866f-cbcf1e958125", "value": "T19B431680FCD2996EC6D4137AA73E318E33A1B3E4D1CA3613CD585B25738A68F5D66B40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671134, "uuid": "f2dc5ff7-1938-480e-bfe6-5c68e18b1d5d", "value": "768:/cyu0nuoHwf/StW3AQoy7EFMQ5Bl5UTyS8kTIM4cLBRKIoNiitsZNMfg8BNdTWna:/lnrHw36ADbEFM+UpcMLLBRKTt27S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768671134, "uuid": "9a0f7ad6-399f-40c9-828d-86b1cb3c19f0", "value": 55892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768671134, "uuid": "a4f55fd2-de74-49f7-bbdb-e3c89baa2ddc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671134, "uuid": "01e0af2c-2ab9-4300-9859-3e221052041f", "value": "windy.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20d30ad4-f3b3-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1768661112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768661112, "uuid": "5a809748-86a9-4224-a086-e2c7f5709f31", "comment": "Malware payload (Vidar)", "value": "bd5004737e36b295275ece733b03f50b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768661112, "uuid": "e6c94855-07fd-4994-a774-61771d7bd690", "comment": "Malware payload (Vidar)", "value": "db73c6dd8f8dc4c7b94c384bc4fbef6d6eb09de30fd30d850413fbe44e0b3f8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768661112, "uuid": "e1cca54c-30ba-4e4a-b7bd-bba42cb20150", "comment": "Malware payload (Vidar)", "value": "ef8ed8e5159fe76653ccd14531e665eb711022c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768661112, "uuid": "7499627e-ff11-4be9-8671-60245cd7b6c7", "comment": "Malware payload (Vidar)", "value": "94d8c1e7b2fe4135ccfe2c0560dc178f1ae73c95c2a671bb1dbeac0db8138d0b5e640f4deea3affc0f27832eabe2cbd4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768661112, "uuid": "9e6f0fbd-0723-4032-aa27-d6f216e22d39", "value": "T184A63BE2FA404725E6DBF239D461615A6230B484133524D7BF690BA59C2FBC8173BB2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768661112, "uuid": "69ab7c10-fbc6-4d5e-afaa-3e939dde4283", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768661112, "uuid": "1aa8b90c-8a6f-4f96-a956-a4cc09f407e7", "value": "49152:oX9OtVyzHt/rb/T8vO90d7HjmAFd4A64nsfJPyHg5HopVPCPZZN22vFYLJPSTNpn:wtYmHRR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768661112, "uuid": "0b4c1845-843a-48c9-85af-a5d5f53ac6b6", "value": 10228864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768661112, "uuid": "ccb6bc89-1890-4477-8f95-dca33759583e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768661112, "uuid": "3eeec207-e3a3-4a6d-b176-f9f31f9baa4f", "value": "activate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fa31f02-f3c9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768670639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768670639, "uuid": "203291a5-ae2f-4b07-a46c-ef02b444097f", "comment": "Malware payload (Mirai)", "value": "31442665bb8ef8a4706458bc7c7a13a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768670639, "uuid": "c792fd31-73f1-4beb-b755-846591a7e893", "comment": "Malware payload (Mirai)", "value": "dbbeda6e6cc2389305398528c6617d27f917b85e12c7d6f6fcc897d4bdc141d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768670639, "uuid": "85c8d477-0b3d-4926-84b3-6236e9dfb6c7", "comment": "Malware payload (Mirai)", "value": "ca1b9828706fb94b0542f6274f1b87f1b7411f39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768670639, "uuid": "35f31e50-72cf-4d57-806d-eec7ae8198c8", "comment": "Malware payload (Mirai)", "value": "f85703b6f8bda4f17d43808305fc76b7c698cb6bc553d92cd8587c8254728129aa9feebded063562694597fe648123e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768670639, "uuid": "3cd74d71-7f53-4c8f-860c-50249529c857", "value": "T19693A61E2E258FBCF79D863547B78E229648338A26E1C545E15CEA011EB034E741FBED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768670639, "uuid": "104143a8-69d0-4699-a715-264c958cf241", "value": "1536:wa/QRnJeT0Q9aK88Q5Hi0eVTiZU3WSkHquiG7oBikm:FencTfedC0eVGZHSkHquiG7ay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768670639, "uuid": "c75b9b9f-cf1b-46c0-8fc2-3ceba4bf0da4", "value": 89612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768670639, "uuid": "40a7e106-79f3-4daf-802c-637aeb471367", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768670639, "uuid": "939e4c78-ffca-4f98-9055-cca65085340e", "value": "vcimanagement.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c99317d-f3e8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768684002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768684002, "uuid": "ef861f8c-49ac-466e-b01b-f59451659fe5", "comment": "Malware payload", "value": "03f9e6f14a7cd9aee034c93b901e6811", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768684002, "uuid": "5599be80-f42a-4e04-aea1-eb24e4833920", "comment": "Malware payload", "value": "dcf324ec0237ae61b9d2534c6f532c4b25f531481708310229cb3667e6e72615", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768684002, "uuid": "3bc1a512-1206-4e67-924c-bc0372056e48", "comment": "Malware payload", "value": "4e7c2e873b50764ba8ca496eea4338929884c7bd", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768684002, "uuid": "f14bcb4a-4f84-45b9-91e5-2d89b70493d6", "comment": "Malware payload", "value": "fec906c1e7248ecf7aae16c239213d5fe29e439e74c71741accfffb063f30a98058bff9be0eb80a8bc8e3d5a4ebcd343", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768684002, "uuid": "89813cee-0d92-4e2d-ad3f-bbd343035821", "value": "T1E8E0CD55FFB513F4FD41854D5DD031D224CDE44968306DCCBD34CE618414700D315A84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768684002, "uuid": "21a8ba8c-7307-4199-89ed-1c9eb9e53ddb", "value": "6:hx60uW913nENFXuXL8EA/yiuuXaMI9QKKi+RbV/W9b:nDVuFXub8L/6YaMEQRiudW5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768684002, "uuid": "e69701df-fc9d-4f99-8d36-36fe53a87d48", "value": 295, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768684002, "uuid": "c998d756-77c6-4094-95b6-12e3b8b99ab0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768684002, "uuid": "64369fb1-1241-4423-9617-c4cf1d37a552", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40754cd4-f3e3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768681781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768681781, "uuid": "ed83cd50-3542-40ca-97d9-5c828f1641b5", "comment": "Malware payload (Mirai)", "value": "df496108cc3490ea1a7cdcf130e40e1b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768681781, "uuid": "c86eca54-a0d7-4baf-954c-3784cbc26279", "comment": "Malware payload (Mirai)", "value": "dd6cc595148c090e9e3567cc2e624e8c7db6a69f57991097bfe4ede1246e49b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768681781, "uuid": "f167bc72-5e16-4c3e-960c-b659b58e3a84", "comment": "Malware payload (Mirai)", "value": "a92a98959cf08cd582a34afcfd802e390ade5891", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768681781, "uuid": "6316e964-0060-4616-9103-f96a86d3d971", "comment": "Malware payload (Mirai)", "value": "dab4a1bf8ebd5a5cb5b35d6befb8cbb51e4ca2b0567ad34d8387f0637c61727e901a81244c2e49def22a3f80863496d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768681781, "uuid": "a960c42a-7899-4b4d-b5f3-3db957f2cdcc", "value": "T1B4D36CC4F64FC0F5E81215713136BB72AA73ED3A113EDA43D3B99A219CA3981D91A35C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768681781, "uuid": "3f0309e0-cf79-4809-8da3-8a025a4597f9", "value": "3072:qNbuRSWV9FrpRNefMP+VBUivPcVOA7blxeRgiC:ub+SWV960P+phA3TeGiC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768681781, "uuid": "b3ff884d-5fd3-4c60-bec0-78290771dc9b", "value": 135852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768681781, "uuid": "29983fd2-8cdb-408e-a007-ebfd935df620", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768681781, "uuid": "421db299-b546-4af2-a912-87a5fe36c595", "value": "Polar.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4796f787-f3c9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768670626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768670626, "uuid": "bc0a4119-f426-4feb-beea-7cfad1113964", "comment": "Malware payload (Mirai)", "value": "edca8324b0abe1c44642dac48ebeae5e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768670626, "uuid": "35c736fc-c91a-45db-97a3-685ef65fd495", "comment": "Malware payload (Mirai)", "value": "ddbdb5529f50c54374066d2d56c4c9d7ba6a220a0f322d52175e2db1e9448eba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768670626, "uuid": "807fde14-96fc-4491-a0bb-7de3b50f4c9b", "comment": "Malware payload (Mirai)", "value": "3dc13da603a235e23e9dc137855536ff28d1c86b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768670626, "uuid": "cab8874c-d979-45c7-9329-b9df9840d20b", "comment": "Malware payload (Mirai)", "value": "ca4922a9999c2e4481492064acfa8677b1e0ba7908edec19e58d121cae178311250535e017afdacb1b2b55434605b426", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768670626, "uuid": "de583dd6-9c17-4c84-8c54-5dcec6c12406", "value": "T1F95339C0A993DCF2DD1146B93177FF328636F436212AE9E7D7D9A923AC81E40910729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768670626, "uuid": "0868f3c2-3d06-4c05-ad75-888cd4cf15a0", "value": "1536:VMzVhePhrkmetvEuckIzN/hkfgiu5BSSs84IlZ6fUoBiA+pTLE:VMzVhePlkmetvBcxJhyu5BNAIlg9oAuf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768670626, "uuid": "68f2a239-c35b-407a-8d22-40af9de7fe82", "value": 62224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768670626, "uuid": "f6af927a-85b0-4534-b185-e6ae5ee5201b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768670626, "uuid": "8a1f8785-f31b-45b8-8974-a156c3b20943", "value": "vcimanagement.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60f2c2df-f34b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768616552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768616552, "uuid": "0feeb782-7bba-45b2-ad5c-df71d60fb622", "comment": "Malware payload (Mirai)", "value": "9692792270b4dce1cf4b50c080d4dbb4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768616552, "uuid": "a9efbcc8-f8a1-411d-96d4-925cc6003705", "comment": "Malware payload (Mirai)", "value": "de13418767bb55e4cd8182ae1158448deb7bfc619d2858f0e020fbe368099082", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768616552, "uuid": "dac73d3f-9f6f-494c-b411-f93f1e0513d1", "comment": "Malware payload (Mirai)", "value": "e52cce772bc25bf70a13c595d80a27caf3ce994f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768616552, "uuid": "41e6c424-fd17-406a-8f3c-016372388121", "comment": "Malware payload (Mirai)", "value": "62fc71bb6e8463323a3af7b13fae91d4d3d3039fdb1002d0f0a7917b69ad3ca98ea9f017a347a6923ac4e976ea4145b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768616552, "uuid": "d8ca2aa9-3c78-4077-82a8-d8a11583ba87", "value": "T1D2731B97FC82E90686C565F7FA1E42CD331703A8D2EA7202DE265F21378A56E0F77581", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768616552, "uuid": "cd0c2964-656b-4389-910a-467985b1e5c2", "value": "1536:GeXTjDtlmAA6ZJWbLDF8moOlxtl/pDZCJDjweguQwm9jWOI4cMf:GeXDbm2WbV2YjZclQwc31", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768616552, "uuid": "1217559b-7f33-433b-9b93-a32cb7cbbc17", "value": 75464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768616552, "uuid": "bb782b62-a685-4750-8b7e-494964f5b507", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768616552, "uuid": "62c36a82-dd2e-4b1e-9523-438d45a2327c", "value": "arm.kok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7474177e-f3aa-11f0-a129-42010a9c0007", "comment": "Malware payload (LummaStealer)", "timestamp": 1768657387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657387, "uuid": "b2534602-fb0d-417b-9fa6-d5cebf851ddc", "comment": "Malware payload (LummaStealer)", "value": "173e6c4c9ea802dc5d0a275ed37fb5d1", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657387, "uuid": "7e431cd2-46ee-4a04-972f-836f3dcf425d", "comment": "Malware payload (LummaStealer)", "value": "de67d471f63e0d2667fb1bd6381ad60465f79a1b8a7ba77f05d8532400178874", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657387, "uuid": "08cccba6-9d04-4fab-9fcc-410e8780a9d8", "comment": "Malware payload (LummaStealer)", "value": "59f3a01535150064d4c27ddc19e93c25c82c1632", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657387, "uuid": "a97bea49-0fcd-4bf3-a3f9-1793bdb528b2", "comment": "Malware payload (LummaStealer)", "value": "e06b1c54cd6884db1558eca736eef78e8913e3f5269f816485deb69a608a421b8959bd35940e85f2e2a66a297e85a87f", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657387, "uuid": "59aa4d1a-f05e-4af9-8b94-1faa39fdb1a4", "value": "T1AE865C93FE544765D6DBF239E471528A1230F149133114D7BA691AAA882FBC8133FB2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657387, "uuid": "b35ce26a-8a82-4fd7-a541-3b79dd9023f2", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657387, "uuid": "369d10a2-2343-4abf-a427-068d2b48fb65", "value": "49152:Z+MBDEtW2kNsidoPcL82VCUITebmgZzhbY:YgHb/tY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768657387, "uuid": "b1498b6b-3a82-4958-82f9-ae68731b5542", "value": 8260608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768657387, "uuid": "0e9a6240-15cb-425b-a5e7-9613e66654da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657387, "uuid": "c8a2770f-0d09-47f1-91e2-b622b97c1f35", "value": "cx-programmer 9.1 free download full.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e20bbd6-f3ab-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768657752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657752, "uuid": "ce91babd-e14f-4f5b-bb66-d87d3b309d16", "comment": "Malware payload", "value": "53e4e92fb5ebbf343b598c7e4c7500d6", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657752, "uuid": "86e87b7e-af06-4c1a-8d97-0db0c4fc6764", "comment": "Malware payload", "value": "df3c03d13eb2ab219e3bc140763b330db61f9afceb18452f702255e21c2aaab6", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657752, "uuid": "3f7de99e-2daa-4b7b-b716-d89d883c5f20", "comment": "Malware payload", "value": "aed96cbe373dd1159033c5339f612f9ee99e8f48", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657752, "uuid": "dc71cb8b-9c02-4453-8757-f7cdeb25346f", "comment": "Malware payload", "value": "dc5ff68a23e0ce7d09f3e55dbd1b719b50c348f30cf72491a3d09aa355a77b03a73b04b005660230b59c06bc3bcc2060", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657752, "uuid": "3590d916-ccce-4da9-b28a-74943e281df5", "value": "T1D2B3027A722082C5F3ED35659AA9720A5D803AE34AD9CDA524C7C6C0D61F6F294F4F0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657752, "uuid": "eb84e713-c7d6-433a-b0b3-5a334643d7e8", "value": "3072:yRJNbmi4vUUM1GqjSHmEB8+u4Zopdy/iV:aXbmfslFjSH18wopdo0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768657752, "uuid": "5205880a-b26c-4be6-a78f-de07f0641de9", "value": 112658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768657752, "uuid": "23882776-3905-472a-8fde-c8eadfab2ecf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657752, "uuid": "2b3bc736-1539-4655-b9e1-8ed6e36993f7", "value": "Offerta_CaianiS_04-12-25.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf231de2-f3c8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768670424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768670424, "uuid": "85f3d0e7-4a44-406c-a354-0cbb72636fdf", "comment": "Malware payload", "value": "60b615289f8ce07e4fa69ac5db986700", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768670424, "uuid": "4c5ea11c-7ee3-40ae-b03f-b358f44900bc", "comment": "Malware payload", "value": "e35d185fdda5332db8018aec3f260dcbd9f2e69a9ce0a28197f3b60b28711af5", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768670424, "uuid": "ff115b77-d83a-4b28-a161-fe30d5300bd3", "comment": "Malware payload", "value": "851071d7d9c3d6b57abe3ee5c30210764307b4bc", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768670424, "uuid": "f2686a7d-821b-4c1d-ae4b-9caba3495ea0", "comment": "Malware payload", "value": "16e7d84a5e22243956b5464e07e80015fa7c3bbdd7a00a7b1459eab8a75a6a3d877fa49b59768f0df52a490de7272a09", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768670424, "uuid": "357a83f6-c717-4f68-935f-1a66f2ced934", "value": "T1F743ADD70AD8DA24C611DEA6F3D078367055B6DCE8D963221AA180F8EDC2544BF89CCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768670424, "uuid": "7b89bcc4-1d0c-4c12-9f26-3f03e4f49adf", "value": "1536:bWhXmmLSXdLW3LW3LW3LW3LW3LW3LW3LW3LW3LWNsSsDDnnnnnnnnJUUN7hGaGaO:bWhXmmLStLW3LW3LW3LW3LW3LW3LW3LG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768670424, "uuid": "fec77e7f-9d81-47ab-8d52-b5cbc9f7428d", "value": 59128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768670424, "uuid": "aae435da-5fdb-4e07-ba27-0c84682a68b5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768670424, "uuid": "dcce57d0-da9f-4ea2-80d4-1ab8572e4924", "value": "1_17_2_1140_16.01.2026.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bf37482-f3ee-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768686417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768686417, "uuid": "d4102517-67a6-404b-a8fa-2e28b05ac939", "comment": "Malware payload", "value": "e4aae07a713cf87eeaf50949ae31f257", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768686417, "uuid": "f15c0347-9967-48eb-b929-92b6e39346e0", "comment": "Malware payload", "value": "e3bfc3b186db6e019abd85df97c9383902ba5b17469cde058739201f831c922a", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768686417, "uuid": "be640153-0533-4f66-92f1-ef23d5bb9ac5", "comment": "Malware payload", "value": "840cbda3be5a165d4fbf3eb64a15588a461129e9", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768686417, "uuid": "ea28e85b-f3d9-43a2-b181-d6227afa1cae", "comment": "Malware payload", "value": "3df5bfd9d24e57acf1770bab8bc8afc04a97a7ef3235052eb5e88734af88c888456d65cca7144e121807db2e9168fdf5", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768686417, "uuid": "18765516-c4d8-4fed-b8bf-3eee40c0b1c8", "value": "T17A864C93FE445336D6DBF239E5A162892230B144033115D7BB691AA64C6BBC8173FB2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768686417, "uuid": "c156a7d9-9472-405f-8356-d8947c01d172", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768686417, "uuid": "a5661de0-ff97-41a5-b3c4-8938497d5aa4", "value": "49152:vOE6rcrb/TdvO90d7HjmAFd4A64nsfJ1LunxFMKiRrybrPIhzqRLBiXkccvHXWhB:s2wKBR2F5U6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768686417, "uuid": "8115b5d8-5f60-4dbb-8084-7cf8c81ac5c0", "value": 8253056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768686417, "uuid": "abbfa947-6026-4df2-88d8-5a689f6b581b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768686417, "uuid": "8df115fa-5a0f-4be9-bf91-10c700284605", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bfa271c-f3e8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768684001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768684001, "uuid": "d24b20fd-10d3-408c-bf26-6f52fdac758c", "comment": "Malware payload (Mirai)", "value": "a001e9352de0507c94e36e3eb62cd278", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768684001, "uuid": "f82f0d4f-52d1-4a56-b386-15cf3abeec80", "comment": "Malware payload (Mirai)", "value": "e3dade7ec1a0db7c080a50d555492ec6329457f2b10801bea3c942550acb62c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768684001, "uuid": "52e365dc-3c09-4108-96e8-00903c546432", "comment": "Malware payload (Mirai)", "value": "1759ea42bef9236d738a32cfd014fcee6b88917c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768684001, "uuid": "d861bf64-81f7-431d-9fae-d69156e410f1", "comment": "Malware payload (Mirai)", "value": "48ec3fdaeb698ec06628239fac14e62ded3d4e86bdd99b1e2c3e22a61f09f5f41c133bc81519d2de14831a42f90d2a93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768684001, "uuid": "bc360524-4cd6-4cbe-a4c5-7bf885bedeba", "value": "T1DE530204CC2598E0DED26B7B5E41D7811BFFCD7A3794BCA063811FB4A68A8553AB6C70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768684001, "uuid": "8b9f9283-8204-45e0-95b3-8d76f50ed947", "value": "1536:nRl1PKripQo3VBASV0Ji9BUQpIBAS4wZE4u+qgw094:tK+VVKSV5CASvm4u+qgw5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768684001, "uuid": "cb43bbec-557a-4ae6-b2ad-4f4896f5a74d", "value": 65568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768684001, "uuid": "6fc0125a-c8f6-47d7-8156-8b6628a21269", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768684001, "uuid": "967e5c49-fc95-4f02-9e8d-adf28f05098f", "value": "Polar.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb86065e-f3cb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768671760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671760, "uuid": "eb05f6a2-7bc7-4aca-b5ef-5c1dc5718961", "comment": "Malware payload (Mirai)", "value": "08455bd424308f170e8c4ec2219a64d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671760, "uuid": "a3845a36-6215-41eb-9073-808280c77708", "comment": "Malware payload (Mirai)", "value": "e46cbe2a60b1161ec4312a517ff6ddbccbf394c4e1e60b6e230cb31ecc1d0a84", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671760, "uuid": "9413f39d-7672-4295-a275-17a2e894bf5b", "comment": "Malware payload (Mirai)", "value": "5813a09deb00e04c0260cce1a64cc02bfa346b4a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671760, "uuid": "64c1d101-5a15-4eb0-b11a-9e2f3c131bf0", "comment": "Malware payload (Mirai)", "value": "f39b766abdfc873ae5a065c2995abce8ace8991bf5b5386c99aa945e096d036f329cb7e583e34eaa67dc96052954f474", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671760, "uuid": "5f484719-5ecd-4eb4-a983-a20f728ca462", "value": "T10AF33B56A6418B13C0D6177AFAEF42453323AB64D3DB330699287FB43F8679E0E63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671760, "uuid": "188d6ef0-cf6b-436e-9aac-d8a3f0db8fde", "value": "3072:IFYTv5Vu8i4kal3Drx8vcc9bSj7AX0JudLAZxLM/9i+Jq8VZ:CYT7Dkal3Drx8vx9g7s0YdLAzM/9rcWZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768671760, "uuid": "c5fb0a12-eaa0-4e65-8b9b-6c0aba12caca", "value": 159722, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768671760, "uuid": "337526dc-acc0-4ed3-98c0-14fbb88161fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671760, "uuid": "b3a328c2-eb53-431f-879b-e0aeeb353ee7", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11b02247-f3e2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768681273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768681273, "uuid": "24475df4-7f81-4d13-8052-d75f15689989", "comment": "Malware payload", "value": "4d823d1d0bf84cc105b378cbf9c01edb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768681273, "uuid": "52ef4dfb-c9c5-4681-bcbb-fe4985c968a4", "comment": "Malware payload", "value": "e6d9252192e0e879a34cd3dca76359cd7bccda5b19f09ede0937587b1569202e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768681273, "uuid": "827df164-c6a0-438b-bd3f-93b28362f6c4", "comment": "Malware payload", "value": "8deb2167aff0fd409a3f2ad2d27744d98ae301f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768681273, "uuid": "b7f2fa3d-c0ae-49a9-84c9-83ac10bff165", "comment": "Malware payload", "value": "0a21682ec1cd845482fc116dd2ae15d1b414f6ce22868531932715e723a91ed7c1b43df8a6b7073eece4e2c19d5a9a8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768681273, "uuid": "46d9e405-bec3-46f5-8562-67a2c76c823c", "value": "T12794F616E620B0A5F89345B03D68A256792D3D392681DD0BF38D8F5A37B1A87B1F530F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768681273, "uuid": "ceaa3849-1d4a-411d-969f-f99da5b75395", "value": "4e72637e395eef1ac3830fa53e0e6774", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768681273, "uuid": "7a897e86-d58e-4c69-a60f-f49f78bda027", "value": "12288:wbwFyPCSbYpTcdg7Umj+a+l1m34Z0MD7:wDS+an", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768681273, "uuid": "21583d4c-5074-4fb9-97ca-24abb2fda150", "value": 417792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768681273, "uuid": "5d8d7116-b526-4e13-8001-9c274317a3c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768681273, "uuid": "cb23762c-fab2-4750-93a7-370b1a75c31c", "value": "Factura_24785467898__________________________________xlsm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d5794d4-f3aa-11f0-a129-42010a9c0007", "comment": "Malware payload (LummaStealer)", "timestamp": 1768657348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657348, "uuid": "69acd02c-441a-406b-a1fb-0892feefd1ed", "comment": "Malware payload (LummaStealer)", "value": "f8fb4341770921522757e937b2acbf7f", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657348, "uuid": "81873b2b-2cf7-4053-a071-184f7e16e770", "comment": "Malware payload (LummaStealer)", "value": "e848d7fccaef8a29ef399d1a18370474e1cb6417fa3607ee6a59a60361c6ab3f", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657348, "uuid": "4b74e474-5f9c-4c14-84da-d413a464287f", "comment": "Malware payload (LummaStealer)", "value": "831e5d391d5b897cfc7c3bd3e0363e46627170b5", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657348, "uuid": "ef6e4cee-1d1f-4185-840d-0aca42d43236", "comment": "Malware payload (LummaStealer)", "value": "fcacc2518d596c1e72d39d57b722c83d284118a647ddb12bee9e5989c972dddd58ec576a5a9ceb90b3bcd377739f3d31", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657348, "uuid": "6e1c08b8-bce8-40c6-828d-c974c17e4ebb", "value": "T122175C93FE544765D6DBF239E471528A1230F149133114D7BA691AAA882FBC8133FB2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657348, "uuid": "89c39207-c8f9-401a-83ab-5e1ff1c0e608", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657348, "uuid": "82ca23df-c209-4cd3-be79-80bbe691dfaa", "value": "49152:D+MBDEtW2kNsidoPcL82VCUITebmgZzhbY:2gHb/tY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768657348, "uuid": "f56a2220-7c56-4341-adfd-f71e449bd695", "value": 18732040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768657348, "uuid": "ce934b20-82c2-4ae8-bf48-2474d30216f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657348, "uuid": "14e45360-7b77-4660-8497-5ed157ddcb05", "value": "cx-programmer 9.1 free download full_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b74d1db8-f3e9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768684557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768684557, "uuid": "39f3ef13-42e2-423e-a339-5707a9ea1756", "comment": "Malware payload", "value": "a4e79b982cbc1202dd427489f365bbe6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Program:Win32/Wacapew.C!ml", "colour": "#5BDFAF", "exportable": true, "hide_tag": false }, { "name": "Wacapew", "colour": "#8847C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768684557, "uuid": "a39ba663-2f99-424f-9f9a-a08ece679deb", "comment": "Malware payload", "value": "e871a6faeb2baa0b10e657a7d0b02f2d669cdc03ba83cf7f4b2095d229ecf0d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Program:Win32/Wacapew.C!ml", "colour": "#5BDFAF", "exportable": true, "hide_tag": false }, { "name": "Wacapew", "colour": "#8847C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768684557, "uuid": "90ad03e5-f0b2-4de8-9e5e-5b7ac89caa88", "comment": "Malware payload", "value": "57d7a475b4cf28d513b7b0c806a785a7b2391710", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Program:Win32/Wacapew.C!ml", "colour": "#5BDFAF", "exportable": true, "hide_tag": false }, { "name": "Wacapew", "colour": "#8847C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768684557, "uuid": "86add319-70ff-49af-872d-55eab0984fca", "comment": "Malware payload", "value": "e22aaa409bf6afa63414246f90ffcdf0cdbc445b2bdbf44ad8b3dd30e2568f2d2d993781cb3dac6d6e14d69f071a7ee9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Program:Win32/Wacapew.C!ml", "colour": "#5BDFAF", "exportable": true, "hide_tag": false }, { "name": "Wacapew", "colour": "#8847C5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768684557, "uuid": "2e4c16c4-1b7f-45f2-87eb-6a6029a22263", "value": "T1E3373340F2A61772DE4665B19EB2A7458A3A8CC34F30F6CBE3C3665727265819B3CD34", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768684557, "uuid": "7dff9522-e43b-4752-b8d5-9fc3a67f1319", "value": "85365a86791a8aa8c2f5c2098e16fb20", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768684557, "uuid": "e6f0ed0d-538d-4899-9b53-4c06c47e3f8a", "value": "393216:2eOaZvZj3YGTNh9P7j8eyo8eZfEUDnPo5kJneuTTNwybirU5tvSVTwtCm6NWC9pB:2nIJoiN/Tj8ehRzPo2JnL8etMFmxCj5z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768684557, "uuid": "e11faae8-fce8-46ae-9dfd-880caa37e976", "value": 23855039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768684557, "uuid": "e676beaa-6a4e-4a66-a6a2-6fb155cdb966", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768684557, "uuid": "0ed84497-9f2d-49c4-9549-0a3121ce9c19", "value": "vue2\u8fc1\u79fb\u5de5\u5177.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6b61fb4-f3ca-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768671349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671349, "uuid": "63743815-0b07-438e-9d60-ba55317d217f", "comment": "Malware payload (Mirai)", "value": "97e5f5f47bcab0b527361d87a25390a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671349, "uuid": "63174d0b-15b3-48af-996e-617d2e899571", "comment": "Malware payload (Mirai)", "value": "e93141f45720a571dd3850f45f7ad587628179a9596f2d7d9d66f2cc35ced636", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671349, "uuid": "485ee58c-5371-4142-a74c-750bb5cf0b23", "comment": "Malware payload (Mirai)", "value": "f419eab391c3ea6ce40a58d4eda274d3bc3cd451", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671349, "uuid": "3b086fb1-0d11-45d2-9f57-892cbee8a41e", "comment": "Malware payload (Mirai)", "value": "d0ef9645985d1839d478312c46c359ec5faf31870060ae3337e12ce5f56d8039aa26d2695cb213d993422e59c7b24200", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671349, "uuid": "399e1140-9df5-4201-a295-978b363a9b87", "value": "T1AF23014A099A973BE14CA17C8DBEF66D2F40EE05518308D78E09F43BB4C6B72336D865", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671349, "uuid": "72eae605-d4c5-4883-8ada-0ffebeb75d61", "value": "768:TSnhOnhzHzuQDTYHkKEzepwEApLAEYbrfuv/tNKeKdhixVaG8JYWamURmON3p26Y:+nhwhD1fKusB0o2KRhwGYWamKx52Mno1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768671349, "uuid": "d41010f3-5124-4cbd-b62e-206eea635407", "value": 46028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768671349, "uuid": "67ae16c5-1844-4f58-87a9-27626067c1c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671349, "uuid": "51e19f93-827e-4562-811b-1a06c51ed601", "value": "windy.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dc8cbf1-f3e3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768681857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768681857, "uuid": "cd3f69f4-d1c9-4c27-a888-469ac2ac0493", "comment": "Malware payload", "value": "6ee23a2b925f2436e90ddef4b14cdbf6", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768681857, "uuid": "5bc2cc6c-deb5-495c-8c80-3d461a61c25f", "comment": "Malware payload", "value": "ea24964f5cc5bbd760cfa0bdf7c2c419e14a70e8ed5c825ef259615b48c03b82", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768681857, "uuid": "ebbf1053-a7cf-48bb-8e8f-71ad10201b1d", "comment": "Malware payload", "value": "ecc857fecd8a49ddb28c8d893de37ce0bd6f1ace", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768681857, "uuid": "d81c2d9b-f284-4e92-849e-c5cfac339d42", "comment": "Malware payload", "value": "4698495a4613bf756b7bcf25c6e9b2ec280f3cfe77a685d0980ee5dc818ef5c3c5fa1944d2f3c72962b0d1c5dea113de", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768681857, "uuid": "1eb3e2bc-fc59-41d2-a830-e78ba65d7c06", "value": "T1C536E9BB8E384C89C6C7F1F69781D6700DEA9E67A4E6E0FA51D109005F43B106F61EB9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768681857, "uuid": "ae45e09e-15a4-4587-95b8-0d52a7c6cffe", "value": "d512f74fd5e290f01bfc48029b75487a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768681857, "uuid": "ef6fe12a-3350-4176-a5d7-afe5b2ac73fd", "value": "24576:pctQmljENdb0/SPNqv1o1GTLpcEGG+6Oli5JZbURHg/jWUkPcgjQPlv3p/wkL7Gz:pcWmdEv8SPNqv1o1uufwo8xw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768681857, "uuid": "251b1afa-e9bf-4e57-9684-bfabdf417171", "value": 4890112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768681857, "uuid": "4be35d92-a4cc-43bd-b778-d693b94e6c66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768681857, "uuid": "b6e6b7c8-8ee0-480a-9d5c-5165953d20f6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14d3bcfe-f3ab-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768657656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657656, "uuid": "0e4d44e3-fd13-4c14-a803-52e1c2d3bf40", "comment": "Malware payload (Mirai)", "value": "910165b90d9a6c487368c7b77b9c944a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657656, "uuid": "e0d795ad-e969-40ae-9cd1-d7fbe6f1a67d", "comment": "Malware payload (Mirai)", "value": "eacbce4094d4a6c50faaf3dfe54d328342aced7a80f4372cb534e07807821baf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657656, "uuid": "05065ece-a1b1-4cd5-8e0a-563a793480ad", "comment": "Malware payload (Mirai)", "value": "39da87ebc481602ee0c4040cf79d2deaf3669e09", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657656, "uuid": "d9dd8b23-89e7-4a6e-9e14-f4082e33a935", "comment": "Malware payload (Mirai)", "value": "715ce8dc029e82d37e6734e1fee19a366a9bc4bf84d89af86930ce1ce54883fd502f1c0f84c17dfac112ec610019f030", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657656, "uuid": "d2f75c25-ab90-4805-9cb4-bcb9cb6d2fb0", "value": "T164D32A49F8509F23CAC612BBFB5D428D3B1A2798D2EE72039D156F61379B95B0D3B042", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657656, "uuid": "9c0e99f7-fa3b-41eb-bdbd-01801a949544", "value": "1536:Ax1GKxrES89S9qL1j0CW2iCBR4VBGxPTfRSPEMH2jpKUnsmYlb6j2wywq0qdb32l:ACAApM4pACW04OhDRSyPs0IVqt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768657656, "uuid": "33044875-a542-4c3d-a3dd-536462396b14", "value": 133728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768657656, "uuid": "85d31f15-5d2d-47ea-8b77-201ca0d5edc9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657656, "uuid": "e947f9da-0c25-47d4-9395-91a427e3b5ad", "value": "ub8ehJSePAfc9FYqZIT6.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b42622c-f341-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768612301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612301, "uuid": "1027b8dd-decf-49cc-bc8f-e73bfb1e072b", "comment": "Malware payload (Mirai)", "value": "12c65c703f3a77448eaaa4127df55c89", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612301, "uuid": "354393fe-1a2c-40ba-82e2-464899fd6b29", "comment": "Malware payload (Mirai)", "value": "eede4018d5b77af1f660a6d8018ba0531c80cd619c49026ff7c4014fdf67346a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612301, "uuid": "cac9ca2e-92d7-448a-bbdc-6246762dbdd2", "comment": "Malware payload (Mirai)", "value": "ed3596b382c2837fc0d03ac34847e9373b094495", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612301, "uuid": "665f0df7-70f9-4b04-a31d-956320d26a31", "comment": "Malware payload (Mirai)", "value": "7ea1b42c05b289d997792b4863eca3f92cb07c96e0af0181d8ef28cee363755c0351208f8370f320843ada94a0082b34", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768612301, "uuid": "93514d3d-1ee8-4ae0-8942-4a6151c56fb4", "value": "T11E630A96B8818F25C5D5037EF92D118E372227E9E2DFB2229E205F203BC652B0D7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768612301, "uuid": "1acf50e6-f23c-4eef-ab78-c65f2c311b2f", "value": "1536:itnPsVkFxV8xk6b5VKLNXduAlCjFlIr57uscvIGiojd70k7h:VqVMkWV8PPX9Cjd70k7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768612301, "uuid": "8984f2dd-cae9-4eff-ad6a-0dd7ebf07d5f", "value": 66864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768612301, "uuid": "081e0035-d8dc-4fc1-b3de-d40a40633756", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768612301, "uuid": "91bd2346-8813-4651-bd4a-7458e5ef8989", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "556af5e3-f3d9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768677521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768677521, "uuid": "c1cd2381-068e-42f7-8be8-b22d07444fd5", "comment": "Malware payload (Mirai)", "value": "a367d284d647170a74f1383bc9ccb3b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768677521, "uuid": "c4150cee-f431-4763-a5ef-1a6336032d12", "comment": "Malware payload (Mirai)", "value": "ef728dc73fe11f9aac29ade59130c96215d151b6c1e74ced52c5a9673a2380a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768677521, "uuid": "01e3e41d-59e6-4b23-a29a-15bde9708553", "comment": "Malware payload (Mirai)", "value": "39d53c505c1294694be9bb6263b4b36bad38d541", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768677521, "uuid": "3f2ba5bd-5439-4e3c-bb49-58214fcdf07f", "comment": "Malware payload (Mirai)", "value": "1a75d1396fdc6cba5b389bd49c5958271db7f5af2a4dbb537f414acda3687c9fe00133df01bda17a626dc7ed065fad76", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768677521, "uuid": "0a031300-96bd-4dbf-8610-b9ba7e95f3ca", "value": "T1AC732B12F3B8173BC0B0B57480776A137EE95A9E0960EA8FBD750D9ADD132D416277E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768677521, "uuid": "896d478e-3914-4e54-ac6c-506e4bcf9b6a", "value": "1536:ptJnt8hG6kl0QWTlAmMRlAsiyCvj1swUY8UTABqU4XlAJIryCIDpHFuB2O89:DRt8Gd0QW2riyCvj1swUY8UEBqB6JC+b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768677521, "uuid": "3b6400bd-5b43-4a21-b53f-59e156a36560", "value": 77220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768677521, "uuid": "27371a7c-ae4f-47f8-9cc9-3fb44d955d3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768677521, "uuid": "5c705ac4-ac29-470f-8ec8-60e5f7383e6b", "value": "Polar.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bcad1ae-f3dd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768679250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768679250, "uuid": "11a73848-97e0-4c30-ae0e-3f814028b1fe", "comment": "Malware payload", "value": "7eeff5382be1725741ff4c38789679dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768679250, "uuid": "6385930a-e0de-44a3-a88f-6c4a7483bfdb", "comment": "Malware payload", "value": "efb7cda283d6f0c144c4374355768bbc57aa09ae12502304328fef7de9d94013", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768679250, "uuid": "17a5ef5f-4014-47b1-bbd2-4e85b714f708", "comment": "Malware payload", "value": "7e6f8b726eccdc166647807bc201ef8ad8b8baf9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768679250, "uuid": "45fe1703-2894-40a6-8edf-7017d3295c93", "comment": "Malware payload", "value": "df66ecd666246f3b033685ed464a7e7f3a41a83523d83aa81bc1906941f3ead0c1592d41726db736a99cb8fe5eb04330", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768679250, "uuid": "0e79f9b7-348b-46c6-b941-d4f99036ae4c", "value": "T1B0A3825E7A218F7DF6B8C73497FB1B34A77922CA2A91C580D1ACD5012E2434D981FF68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768679250, "uuid": "977f885f-f2e5-4f2d-bd28-b3768bf0a819", "value": "1536:fmdurU07J8MtqHxqGPkncW/RVi/wJz8H6xVRFOr4kp6ShIH:fma7JLqHxcncWZViTH6xVRFOR6Sho", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768679250, "uuid": "3d24ebe8-6c01-4f15-88fd-e6f9ad5ef4f4", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768679250, "uuid": "32c6113b-9807-468c-b1ea-a483cd2d2f23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768679250, "uuid": "5eabc4d2-6445-45aa-8709-d0e2861f69cf", "value": "tftp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d846031-f341-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768612305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612305, "uuid": "ddf1760d-cc35-424a-ac0a-6b565caa22ae", "comment": "Malware payload (Mirai)", "value": "59f7826e8815ffaf5bf3979b9353b115", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612305, "uuid": "eb6f3a4f-35f3-41b8-9779-445d60364bde", "comment": "Malware payload (Mirai)", "value": "efbb64104422651f957cd2a2f5b1330882ce3b1c5ba69f3f1ecaa1e9c710505f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612305, "uuid": "4831c556-16b7-4d59-a6de-554d4c348e8c", "comment": "Malware payload (Mirai)", "value": "99930604accec54daa91f3ed8b09261eb431c8f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612305, "uuid": "64a61137-69ce-4900-8570-fc35ea1e71dc", "comment": "Malware payload (Mirai)", "value": "200f7753c49f46d16bbf998d22f7c90e0064cf4ac5cd3cd542b595620ffbf6008db87a1cffef2624bf1f8059e786d62b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768612305, "uuid": "335b29ad-e665-442f-824b-2fb166e9d3fb", "value": "T196230891BC819A2BC2D41379F5BE998D3360B3E8D2CB3227CD614B107AC551F1C66FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768612305, "uuid": "be623769-b6cf-49c1-b832-8b66a2e18567", "value": "768:5PwCxmKFReSIn9ygAGxc02k8c6ZQ48PHAmWun/RWFQ/MmUB1mA2EDEy0eYjW9THD:5DmKF7Gxyk8cqoHAmWurAufsG5w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768612305, "uuid": "91a0f03a-9f48-4034-965b-d68902e1e43b", "value": 47096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768612305, "uuid": "de1c1fb1-7d3e-4ecd-ac80-b32d77b16195", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768612305, "uuid": "cf1c9ef2-7954-4882-ae59-25dbd86cb41c", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "783d8916-f341-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768612296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612296, "uuid": "60369aa2-834b-424f-8fa7-078b81db55b2", "comment": "Malware payload (Mirai)", "value": "eb7315833b6d9f6ac19946d32890a478", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612296, "uuid": "e9f68732-2c67-4452-998e-f4415a6ff469", "comment": "Malware payload (Mirai)", "value": "f131960c84afded18ef8faaf98eb9bb1f85de72cbf95cf0e23efc12b171690be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612296, "uuid": "9364f3a9-1482-44cc-adfa-802c3ce0666d", "comment": "Malware payload (Mirai)", "value": "2b91b48d66cd05faf19e8ad963c85e994f231ebb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768612296, "uuid": "68f598e6-2323-4e76-98fa-11d37842877b", "comment": "Malware payload (Mirai)", "value": "90ca01839d156bb7fda432906836e856d274f88e7d2d760ab9d91da69f70a4cc893195262e5a83d3262042aed07228e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768612296, "uuid": "a38776d3-3243-4bea-a729-3df9ba1a2cf1", "value": "T1E073A409BB600FB3DCABCC3705AA2B0139DD665721B97B36B934D918B90B25F15D3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768612296, "uuid": "5735b59a-3eb1-4d99-b7e6-6b4a4c9a3744", "value": "1536:zJPEBmW5iNWqcGTkwnXHZ84OqdZerEStK:zJPEB8NWq9hqqd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768612296, "uuid": "7efd6301-fa86-40c2-8ff0-99d9c531b27e", "value": 76120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768612296, "uuid": "e614673f-f5cf-4f12-881e-e3fe97b1a0f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768612296, "uuid": "28e225ca-1c9f-4053-8cc8-3a71ef64c05c", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ef540b5-f386-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1768641942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768641942, "uuid": "f67d7420-cba4-458c-89fb-13aaf4b7c33a", "comment": "Malware payload (CoinMiner)", "value": "68b8f427224a0ef22e3d5e03363fbef8", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768641942, "uuid": "a6381305-0f07-4fbf-91ee-eb6bb92f99fc", "comment": "Malware payload (CoinMiner)", "value": "f1f57eb28380e340acececdea76a5efb3617d597225c13be9a954cb159907be0", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768641942, "uuid": "a17d5dd2-0948-45e7-ac52-1dd3698a9469", "comment": "Malware payload (CoinMiner)", "value": "eae40ec64965120ee4d5ac58faee1f219891d349", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768641942, "uuid": "3097eabf-741e-46d8-8547-f46a4ea786e8", "comment": "Malware payload (CoinMiner)", "value": "a4d560f58d8bd875c335b01a2ab50b3563e447c91c4ed956f8e8de92d44bd46a7f788b7b4ecc40a9c5485cf018bcc8ba", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768641942, "uuid": "9896ee3a-de0d-4707-8185-bb7812f93468", "value": "T18D5533D2B6D3C6CFC4F3FA39941846BC79353D2A5906030B9A6D43B77A1AD680B87D12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768641942, "uuid": "bb921c7f-26a6-4c56-ae29-e6e35f461006", "value": "24576:dO7EQb5XgACLCKdjpfYnWN+ZPhTUu5UPsDGyMVYNVZpUPp:dOZnWkZP1dUuMVYHwPp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768641942, "uuid": "32dd0677-2b27-4555-a781-e775bdf08293", "value": 1308604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768641942, "uuid": "1d671685-df3f-43fe-951c-15cb61a148b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768641942, "uuid": "d3bc46cd-7296-4fbe-ad3c-73febf60c9fb", "value": "poop", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "329028ea-f3aa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768657276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657276, "uuid": "62cb1820-35a0-4dfc-87c1-4a5ae330cd7b", "comment": "Malware payload (Mirai)", "value": "e35bf4134aaecb3a31f32cd09895733b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657276, "uuid": "2966f84b-c2ff-47ca-a9bd-9044e92d0562", "comment": "Malware payload (Mirai)", "value": "f4077b18c1b588822101345d02f1ccbf12c8cb6dac610f9f58cb7ace00b6250b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657276, "uuid": "55321dfa-b948-466a-9fc7-6fec686ae888", "comment": "Malware payload (Mirai)", "value": "71245aeb30518828702d2a85952570e11f937cd0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657276, "uuid": "a1c25cc6-c50b-4855-ac56-61913fe63ee0", "comment": "Malware payload (Mirai)", "value": "39bdd385074a8067ddb12a104e7b3dacef8269750390bab8d07523ed95f969d1f0d6d1638217254f8beaf54a039c60fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657276, "uuid": "e5d9fadc-e00e-4080-9aec-1f56726c76f6", "value": "T1EF530295830A6DC89EB12A33FE7A43856AF45BF8E27F3844ABAC425C035511D0B71EA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657276, "uuid": "8f031aa7-072b-4d87-9c70-c4ed3ab8811c", "value": "1536:6dJgoyBTDYFUi+Nz1rhtfbtfh3e1PLNwqF0ETsUJvuwA:6dYTD2UiUX5leJL6CJHGd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768657276, "uuid": "15cdbd7c-f6b8-46a7-a2aa-b92689208c76", "value": 61504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768657276, "uuid": "2be14c0d-2fa8-4dd1-bfc3-bea7956d5a1f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657276, "uuid": "9cd93b5a-3b27-4658-9105-bc11b944295d", "value": "ub8ehJSePAfc9FYqZIT6.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5db0396-f3e8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768684233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768684233, "uuid": "d230c4b4-4a63-4b19-9447-fc03bfa9e973", "comment": "Malware payload", "value": "a4bc9e249113a53fa47dac34384933ae", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768684233, "uuid": "dc7afd3c-3dbb-4fac-84ed-0414e3c21433", "comment": "Malware payload", "value": "f4acdd2f2b437be79df5851bd9073fd9ca79491f91191cf012aeb53cf4aaf771", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768684233, "uuid": "02453626-7a73-4d55-bfb3-6de122eeb940", "comment": "Malware payload", "value": "9247f1e4cbd676a2f02049201204eb06e1068a74", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768684233, "uuid": "cd28ab31-b00d-4262-82d1-2b99c0fd876c", "comment": "Malware payload", "value": "a8442bd4803fa693b70845ad1ae1052307e22ed2e67ed3d13cded396100f5d32cc2a741b06c8d3d9fd754c53c3e30d8b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768684233, "uuid": "0a7bbde8-654a-469f-8e8e-fb44f955a05e", "value": "T1F2212C9D03E1718AEA130DD86810C04EB3FEB3E3B790C650AEDF5864E0AD2487639A75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768684233, "uuid": "348622bc-870f-4243-879e-f5c27381a062", "value": "12:3J3iv5U02Ov5h8NINMbv53LKev5Uv5vv50Qev5VW7Mv5HQTjuv5fzwhv5n+v56Cm:3J3jbNIWKs7QTgzwDGCyA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768684233, "uuid": "b9963202-5ae1-4afa-adc0-54f4a386d9d3", "value": 1248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768684233, "uuid": "c50af43e-d406-42c8-a83f-df6d01ca64bd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768684233, "uuid": "9ee8a4bc-115c-4311-b1a4-90066ce25344", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3343477e-f3aa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768657277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657277, "uuid": "03f0603f-a19e-4838-b793-f370e3ae6b4a", "comment": "Malware payload (Mirai)", "value": "9ddbea38f7c8634b44f99197d07510f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657277, "uuid": "200c8e76-bcfb-4e89-a609-362d7502355c", "comment": "Malware payload (Mirai)", "value": "f52ba4e1d7b209b1bc466b661af72da8a7c96505364ead5afe9ea232f1b6e98c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657277, "uuid": "d4a17a28-52f7-4dc2-98e0-30bbb752d6b6", "comment": "Malware payload (Mirai)", "value": "4247dcafc02f662f8a3609d630d11c9dde1955d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768657277, "uuid": "7b525a3e-fca1-42b6-a967-f0bd342327c9", "comment": "Malware payload (Mirai)", "value": "bf3a7dea7048f18ca703ee1007ab2ae0aae547193c6486776d6e9097ef73861b44b39e74d89dce0ad65119bff683c49e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657277, "uuid": "289d8f59-46bf-4ecb-94a9-bf549580e00e", "value": "T101E329C7F900DEBDF80ED77648534809B130BB9149A21A377357797AEC3A0E8446BE96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657277, "uuid": "499caf85-3a14-4965-8c0c-2b8b03f97f71", "value": "3072:b7MugLLD4vnzXH2DQJI4gJzIvUCfwfVMjbiKLhsExpyk9S9hK:bDgLLD4iDQJIbps9fwOLSiykMhK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768657277, "uuid": "7608550b-512d-4329-8ef1-1e51d89116f1", "value": 153408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768657277, "uuid": "55f1d1c7-3814-426a-b1bf-f06019a4a44e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768657277, "uuid": "11fecb32-ae04-48d0-b8ce-6972d8e77e50", "value": "ub8ehJSePAfc9FYqZIT6.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de6bf99d-f346-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1768614615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768614615, "uuid": "239e655f-b8b3-4723-b1ec-c131c069d9e9", "comment": "Malware payload (ValleyRAT)", "value": "186bb07829c7df32183ad4073dba4088", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768614615, "uuid": "792e1c0a-91bc-4447-801a-5b95fa705826", "comment": "Malware payload (ValleyRAT)", "value": "f541b4c456b6c232d9f4c8cdb60aa4c34d19776494a20b78391d2cfe51c826b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768614615, "uuid": "3fa8b8d2-3eab-4191-900e-7ad7fe45e82d", "comment": "Malware payload (ValleyRAT)", "value": "003875a0fae34aa0fa31295d9493fd4b27a55c0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768614615, "uuid": "bbe66a7b-b86e-4c3f-9dc8-e2cb67c49c82", "comment": "Malware payload (ValleyRAT)", "value": "92ac780169b1b7f98e730079e6662c79c8bee2e79f1198cbb50615ea0df684479223e74f869a622f2e103f20c8c66271", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768614615, "uuid": "c9bc4bf7-4678-4835-a223-99004862973d", "value": "T1EFF37B2136E0C073D153213989F5DBB28E6EBCB20B6555DB6BD50B7E1F302D29A3835A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768614615, "uuid": "309ee65a-8651-44d9-b47b-2eccd9e45bb4", "value": "1fdaeb54e1a420b9565bb2d23869778b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768614615, "uuid": "a2bd7fed-4be8-4a24-b527-83876e05b497", "value": "3072:p2AdKriweGVg6NZfJmdiS0cF3JSGug0bLaSCNXEpKfea:p2AdKreGVVTxmdiISGX0bLaS70", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768614615, "uuid": "0a9b8258-22ba-4e5d-a64e-d748ca81ef21", "value": 160256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768614615, "uuid": "5891ae7d-7cdd-4a75-bdd5-362d16f76788", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768614615, "uuid": "984924aa-5b04-4b2d-b2c9-f5c384d96562", "value": "186bb07829c7df32183ad4073dba4088.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "722e8fab-f37b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768637197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768637197, "uuid": "912753cc-bc8b-4db1-8b7e-02041906b3e2", "comment": "Malware payload (Mirai)", "value": "869968623c665c4b63c257d993b1730f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768637197, "uuid": "c33ab24f-3113-437f-af80-d0ccc2b895cf", "comment": "Malware payload (Mirai)", "value": "f5428fce84a53a4426b88af0f048f6eafecce6e0b69593a4b46ff7df4d1ac4d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768637197, "uuid": "e0ef5263-e837-4df3-a30b-e3f455029808", "comment": "Malware payload (Mirai)", "value": "e5b3269d0855e402fff425ed208ec83baa4cd345", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768637197, "uuid": "c0a3ba91-64f6-45c5-a3ee-d84f0fb50fd7", "comment": "Malware payload (Mirai)", "value": "cf9266c3aab8a4b2635d7d0ec5b2373d81d8b75269db189e66f1a06380effca9d914661d25b539d06f11d4133282057b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768637197, "uuid": "0a30f8df-bdb7-4ce1-8cad-951c366aca15", "value": "T1CA230271850ACEB124303C76EAD5978376E02AB1C6673123C6280B3C6F757531E5BE4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768637197, "uuid": "8b328db6-19d9-4833-a74a-ab7efa41293e", "value": "768:D/TYCoIxdEk+AxoTZAZHFeq8b3a19q3UELbUXfi6nVMQHI4vcGpv3:DECFd+A6YHAxaILRQZ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768637197, "uuid": "41a8c646-9765-438b-a758-b068118b1fc8", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768637197, "uuid": "35a3807a-033d-4e61-aa06-084223b77e8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768637197, "uuid": "6ba15b7e-85f0-4b80-82cc-499f60fb676c", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62c564a0-f3cb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768671530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671530, "uuid": "4117e2b4-936f-4c56-8370-69fa8bc6038e", "comment": "Malware payload (Mirai)", "value": "381af22be1ed5e0339c7059e385b26c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671530, "uuid": "8eb6e28b-449d-4727-a3ab-d4b38833ee7d", "comment": "Malware payload (Mirai)", "value": "f5438fbd275e781108027bebadf5717e1c27d8a70803e02cdb2a6056771b0550", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671530, "uuid": "cab19a3c-2ac8-45c1-aed7-402031ff39dc", "comment": "Malware payload (Mirai)", "value": "d6bcba1326a9c573b0f8e72202a77c158d99a596", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671530, "uuid": "7724de72-dfb2-4542-8cf5-27e797fd7cc4", "comment": "Malware payload (Mirai)", "value": "642cdebb4284a4f9c976a6f07ec49e12afa5b359c467c251ae998898d8470ac1cbf58e084962966301fd9948f3d53a7d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671530, "uuid": "e9bd687d-f436-4b63-8f71-d5a0e663b583", "value": "T14E934A47B98080FEC49AD13487BF7536D533F07E02F9729A27C4AE262D4EEE01A69751", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671530, "uuid": "639d177d-fd65-49f8-ad32-d3a5ba715b02", "value": "1536:ISjwERNrLhUq4Z/Z1o7mI5TMBbjzUu0p8DEuANz3yk:IERLh/4ZKmiMBbj4p8DERLyk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768671530, "uuid": "c2abfc49-baf5-4e18-9c7f-0065ffb3c460", "value": 97304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768671530, "uuid": "5a795fd6-396a-4464-b0fe-48712dfa0e84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671530, "uuid": "643c7288-a5dd-4afb-ad65-f6e4b54b8a56", "value": "windy.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96923e5e-f3eb-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1768685361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768685361, "uuid": "e93d3aa2-7bca-4f87-b167-509acc0feb04", "comment": "Malware payload (ConnectWise)", "value": "b3310484053ab0a7bd91832e480aa0ce", "object_relation": "md5", "Tag": [ { "name": "cloudsynn-com", "colour": "#3944FC", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768685361, "uuid": "87303b3b-00bb-491d-860f-4b101dabb942", "comment": "Malware payload (ConnectWise)", "value": "f559d5caf874b98fcbddb13934cd29eb6e18e2ee8c7dd6d256c9eb37359a49fd", "object_relation": "sha256", "Tag": [ { "name": "cloudsynn-com", "colour": "#3944FC", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768685361, "uuid": "c72f79c3-3eb9-4855-844a-5389631b7a63", "comment": "Malware payload (ConnectWise)", "value": "87253fe03d8cf9cff6f0d7509096b63ab6e3a8a2", "object_relation": "sha1", "Tag": [ { "name": "cloudsynn-com", "colour": "#3944FC", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768685361, "uuid": "b92d7047-c51b-4663-b183-4b63c27e45a1", "comment": "Malware payload (ConnectWise)", "value": "d0d592df88b96f4e4b9cf666cb601f6ca903b63fa2bbe4abde37307e2fde7d8828b9dc04d1a44774c13dd1a180fe7df1", "object_relation": "sha3-384", "Tag": [ { "name": "cloudsynn-com", "colour": "#3944FC", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768685361, "uuid": "d0bc8437-e9d3-4017-b9c9-082e309156f3", "value": "T112B6231473F8A119F2B72A3AED3951F15C767C22CD62D15E17583A4D2AB0E818AB3373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768685361, "uuid": "1b178396-e628-48af-a7a0-ccf8e09ec9b9", "value": "196608:3op5ZZ6ryGD0yANlDdBHGbQE9d00AGqHGbQE9d00AGIHGbQE9d00AGpHGbQE9d06:3UJ+03NldBmkEd0mkEdOmkEdHmkEd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768685361, "uuid": "ad6556d4-6317-4fdc-8f2e-a0a17b52c55e", "value": 11251712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768685361, "uuid": "74f3b70e-8074-4e5d-a86d-449f37390218", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768685361, "uuid": "6216d40f-2b40-42ec-b911-f0219231e656", "value": "vcredist_x64.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fc3242b-f387-11f0-a129-42010a9c0007", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1768642239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768642239, "uuid": "178e55a9-312e-49a8-a359-316b81ee57b2", "comment": "Malware payload (Socks5Systemz)", "value": "2481a9a9b122074e464f7fb94150fb63", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768642239, "uuid": "cadc8563-701b-4f6b-bac8-1f527b5648f2", "comment": "Malware payload (Socks5Systemz)", "value": "f56a0e2bce867b44c7a2614c72408fce2d5d5c6eda054d880ab8ed39840ba96e", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768642239, "uuid": "409df707-5416-453a-9a31-4788ad108754", "comment": "Malware payload (Socks5Systemz)", "value": "cdbdc881d232e32c439605349e928a56c185a4db", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768642239, "uuid": "f0d08a70-4e43-4ab1-87cc-6d178ecac7f5", "comment": "Malware payload (Socks5Systemz)", "value": "1142a26208f372ba0f696bb35e114736a24eee399acbbf541d06127701269aa9b3cc43dbc19444b0b6ac3e739060b66b", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768642239, "uuid": "cba8319a-596b-4478-a94d-67607f1818f7", "value": "T1A006331473B29430E005AEB5AF35068DA1B3EE2D24394A5D249CED8E6FC37525EF5F82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768642239, "uuid": "df638ea3-1ebe-4472-831f-919b25fe47ed", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768642239, "uuid": "d9b02dc4-5a06-45c4-9c26-ff259800290c", "value": "98304:MaeN0mBJ0TWYlUjqVvNUBA5QH3ye4pFxk+BFdaYX93moJu:pwTJ0yYlYqRNYSQXF4THHX8oA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768642239, "uuid": "8702e87b-b5f8-4eb0-9ffd-2152f2c1b1b4", "value": 3710766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768642239, "uuid": "83b0447a-3a4d-445d-945d-71216e0d9377", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768642239, "uuid": "627758c0-631c-4441-8d1c-eb2fdb638414", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dee8e36-f3b6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768662530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768662530, "uuid": "e81a3073-234b-4273-97c7-58fb39a6014d", "comment": "Malware payload", "value": "1bd7edc0c98c237be25834c070c7d87c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768662530, "uuid": "86bcbc19-7a5a-4a54-853e-5194d3df0801", "comment": "Malware payload", "value": "f61cf89ee05f9ca7a136ef41cb841f85030f1c6a8c912e3953e9c0428f717cb2", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768662530, "uuid": "cffd6411-79a8-4ee5-989c-d62ed6c28e2c", "comment": "Malware payload", "value": "a56b782d4a8ab3144ba39ef0d06bc10c7a4bf051", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768662530, "uuid": "246f7b67-da95-49a6-b6c0-6c20470b06b6", "comment": "Malware payload", "value": "1c7a41af3aafeab56ef239950c7f2caaa878cab4f25723a9142e70a834a9427aa169b676c79be71cea19e2922a2832f8", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768662530, "uuid": "346fd6f1-686c-436f-a576-79bbdeb9ff64", "value": "T123F2CF7213BC608FE3B434C280A0759A1B037A9D42A6547B9E4FE0D2F5B60F9F2BD955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768662530, "uuid": "167f5511-d030-42a5-b3c7-d93061833d29", "value": "768:6d1j7kHETc81qZxXFHz4b46RNukkdYN6q/7VDbkmqrOSnvyGE4Dr4up6hkWqQo:Tf81Y1Nz4c4kdYr/7VDbkmqrVnvyGdrH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768662530, "uuid": "2c5d955d-aa1f-42d9-b886-847d13d4df21", "value": 35380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768662530, "uuid": "7eea7236-508b-4a5f-9f77-d5cbc95f5aa1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768662530, "uuid": "b9eeca1c-69fe-48f6-b4c9-b70ad2140cbf", "value": "Nabidka_Pozice_Riha_F_06-01-26.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a70c445-f3cb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768671543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671543, "uuid": "803697d6-1770-4744-a477-54e96f80c2f6", "comment": "Malware payload (Mirai)", "value": "ac493d8cea686be94e43262d5ef5a9a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671543, "uuid": "89a7441b-dbe9-48d7-9483-db08d71633e0", "comment": "Malware payload (Mirai)", "value": "f89ff6f6aec5fba3f164029965a75f5bb02c9c465ffbff1215ee8cb27c5f1ef0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671543, "uuid": "8ed1070e-8432-4804-a283-8db591b9b481", "comment": "Malware payload (Mirai)", "value": "22ef18d3fb5ce4d2350428627f87dbb32f3c10a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768671543, "uuid": "02982c16-09a9-454b-818a-8e411fdc4581", "comment": "Malware payload (Mirai)", "value": "b87c588abd419b75ad86cc984715ad33b0ae4635fb841a0843f6b72b291379f9456a68a5b0f8038793dc68bf7a2a4eb7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671543, "uuid": "cfe0f0e7-3c1c-4456-9d4c-f49d01e6567f", "value": "T115144D46DA418A53C0D32779B6DF62453323ABA4D3DB33069918AFB43F867DE0E67601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671543, "uuid": "eeb11eed-fd13-43ef-87c8-71d9a9df4a9f", "value": "3072:pDuPx8jzfZE1YETJaGPf71brt829k840oRIFE6Xpuve4vWM/917QBymmxwXhFJP9:pDuJsE1TJaGPf71bru29k0qIe65uve4i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768671543, "uuid": "421c8287-7fac-42ca-b27c-fc57c5e77f35", "value": 195257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768671543, "uuid": "83d30d24-bab2-4340-941b-7ee08e0e883d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768671543, "uuid": "ce19bab4-ab14-41e6-862b-d80161d81d04", "value": "windy.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58b1faa0-f34d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768617397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768617397, "uuid": "b9b98abe-5e5a-4708-92af-29d50f1d8f3c", "comment": "Malware payload", "value": "51c4bedbdb74e6b0e5ab40e0ccab5a3c", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768617397, "uuid": "5e38dfdc-11ea-4912-90aa-ddc2377151d2", "comment": "Malware payload", "value": "fd0ad75d830feb3779c51b61a2a0e0b866b203438ec1b5b4c3c5952c3fddc818", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768617397, "uuid": "1c4986f9-40e3-4cc5-87ce-42daa2590de8", "comment": "Malware payload", "value": "0d9aabb002b4fd72ef570133cf9e4b68232b2df0", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768617397, "uuid": "e7871c6d-108a-4ae6-9fe4-ece2ba67d725", "comment": "Malware payload", "value": "63a83ce612938454c11e675cbacd40d8c8757eda18514ffa7cae0a0c1f7e96bbf4d4c8bbfa73dd6570c3186319c212bd", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768617397, "uuid": "c30fe9b0-c20f-4692-ba6d-86ea7ae7a440", "value": "T1562432311D8F3D9D4BBB845ABFFE94E61B4F03391489508B594EAB9CB409026E0D6DCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768617397, "uuid": "1a31a28e-329f-4937-a322-fe4e9ba400b2", "value": "6144:m0TikQjOBaN+ApzWQ8X9J5s8NiZ4ZLDboPFKdQyzGXaAAoiT:zyOBaN+ApzWQ8X9J5s8NiZ4ZLDboPFKd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768617397, "uuid": "f041bfac-e525-4627-98aa-68acc1bb1445", "value": 219180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768617397, "uuid": "8562e618-a8ef-402d-9c32-7d25331fab8b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768617397, "uuid": "5f94b0b2-5f59-41f8-b945-c3aaa427d1ca", "value": "Alpha31.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }