{ "Event": { "published": true, "date": "2025-12-02", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2025-12-02", "timestamp": 1764720181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "9a8b688b-0f83-4143-8c55-d655be1c1b35", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fa31f88-cf99-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764691889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764691889, "uuid": "fa08e952-fc84-425b-8deb-e1ff2a7388e4", "comment": "Malware payload (Mirai)", "value": "77131a9dbd6443ce99d91245b3883074", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764691889, "uuid": "2cbb3166-908e-40f8-82f7-9dcc3eaa5267", "comment": "Malware payload (Mirai)", "value": "0133bca03aaf8c4ea5dcbba64af8525b3b0a7648bc2529dc0bd0d5f0c760d359", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764691889, "uuid": "0679ad60-44ba-4e8b-8c06-3d9e2eb2e921", "comment": "Malware payload (Mirai)", "value": "a090226e9cbb6e1b722a571bd1328f59cbf81522", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764691889, "uuid": "fb2ee98e-c9de-4f15-964b-71ab62f19b09", "comment": "Malware payload (Mirai)", "value": "b018d74f55651cce9a82558e3dcaa59ce78c17d41514223ac8fd87718817adb76f80ff5fb1091179742d863ea5407f4b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764691889, "uuid": "60fe3b42-b952-438f-84c5-ac4010097cf7", "value": "T174743A46EA418E23C4C217B6F6AF4246333397A4E3E7B20699285FF437C775E0E62645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764691889, "uuid": "8165e7d1-9eae-4f1a-8d8f-0d730248c45a", "value": "6144:DJOikmEUCC7Ck+S5F+HLbCi46as4t89T+xyFw3WHcNq8+qoSM/R9lmY2ec0imSka:DJdnEUCC7J+Sz+HCi46ant89T+A23W98", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764691889, "uuid": "909f0467-9a6a-4e2b-a550-b9e4c277ab8e", "value": 338044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764691889, "uuid": "84c578d0-39a9-4c87-ae98-139ba6dc3786", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764691889, "uuid": "4c4e5a66-4f69-46f5-b89e-057edd37b924", "value": "ecco.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51f8465c-cfb5-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1764703811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764703811, "uuid": "d6ac2c34-d970-45a0-bd89-e88c52738085", "comment": "Malware payload (AgentTesla)", "value": "2a72f4990717038e7c9ff8d55298c98e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764703811, "uuid": "5ae5c85b-7a72-4c3c-8287-4cc9b4b3092e", "comment": "Malware payload (AgentTesla)", "value": "01ae9da99db03e2e97c0a99c4147fa01d0838064d056b68accba84d16d36fea5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764703811, "uuid": "d783c32e-27ba-44eb-98be-e8f7b06cbd4e", "comment": "Malware payload (AgentTesla)", "value": "130b67cc2d22c7c6549112ed78f91e8e64c6847e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764703811, "uuid": "69db0ac9-0356-40bb-a43c-e65582c277a0", "comment": "Malware payload (AgentTesla)", "value": "311ff6b491cfd967b65d63cec89d4f58ff2274fd16840dd65e522af5b8ff97b4e681f36f99174ae507274f2ffb0027a0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764703811, "uuid": "da4bd38d-5e4b-4ff5-98a6-d9d2cf669cbd", "value": "T11535AE0273C1C062FFAB96734B56F6115BBC79260123A62F13981D7ABE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764703811, "uuid": "5d4bfc7b-9195-419c-81a7-5e4514839280", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764703811, "uuid": "be01d625-78c3-414f-abb2-161df462cc8b", "value": "24576:45EmXFtKaL4/oFe5T9yyXYfP1ijXda+9AJB/6egR:4PVt/LZeJbInQRa++JBb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764703811, "uuid": "ca712486-909f-4c34-b9bc-88cac7692a43", "value": 1086464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764703811, "uuid": "97f0ee0f-88f1-4456-b4f8-6f786a3df113", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764703811, "uuid": "0ed2bd5f-62f0-4d75-a1e8-724063995177", "value": "rPO0312025TOYOBO3_.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f125675-cf50-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764660401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764660401, "uuid": "205d4e06-c0ef-46b3-9725-c327f3a67394", "comment": "Malware payload", "value": "1ec2724be59f64f05f7107728b51624f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764660401, "uuid": "068e3e07-dbdd-4ea0-b939-9b14e891a2d0", "comment": "Malware payload", "value": "01fe66a8aaea0faa04b12127caa3b76ee11be9ed0b1bfcd1eeef71aa5489faaa", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764660401, "uuid": "3cecbb12-dd94-4a5a-a08b-7e3449fa484d", "comment": "Malware payload", "value": "a2102270c3cb8db9fdd71f2411ee457aa470e3de", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764660401, "uuid": "63cb56db-9f80-46d8-addb-30412bcb001a", "comment": "Malware payload", "value": "e46879b3b80ef732074cb99763ace837138be5b6b84e1054e5a3b3977374d72983c889402c337b64e82442bdea722045", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764660401, "uuid": "539d4aa6-fabc-4327-85ea-82faf76cd354", "value": "T105B34A4237A940B6E2A7923589A38A86DBB2FC50577647CF1668735E2F737C14E3C321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764660401, "uuid": "3f6c6eeb-66dd-4544-8e1d-be360cb37100", "value": "a1f040204af5d60a1984c8c9e3e2f68c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764660401, "uuid": "a9276db7-9d3b-4c98-8591-7aad2e94badf", "value": "3072:n11IiZWF6Qsw/Iz4uaTb6lk9O6YjCbwS5MsDMy1:n11Ii0F6tz4uaTb62tr1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764660401, "uuid": "0c5db605-8fee-48f8-8457-2f8162f8aadc", "value": 111376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764660401, "uuid": "3d4699ef-75ac-40ed-9881-1ce4428c970f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764660401, "uuid": "0edd9180-dc91-423c-ad4e-fb0dca5731b1", "value": "IObitUnlockerExtension.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96e23895-cf2f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764646375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646375, "uuid": "e559b766-83c5-4a9a-876d-cc3cf12b57ee", "comment": "Malware payload (Mirai)", "value": "c4f3695bd684f0c32b295d6ee5b5a5b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646375, "uuid": "e31902f9-3ca8-4792-9e3d-a714c33aa7c9", "comment": "Malware payload (Mirai)", "value": "0249c2b4907605bedc953914cb05c7f507d2c0be8377d579f84311e2352f6495", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646375, "uuid": "79e1cad3-4d98-42d6-af97-5c2773f44bf7", "comment": "Malware payload (Mirai)", "value": "132a3f1f92ba165d3339e59778476b0ddb7f5235", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646375, "uuid": "e6cd6d2a-01c7-41d0-9074-fa79805513cb", "comment": "Malware payload (Mirai)", "value": "f8ee3a2984ba00bde6b9cf113612178dab1e52707f1d392351e382e44a07b1484ea5e6106222f5441b88aa7fe8439172", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646375, "uuid": "98dfd4d7-7e57-4c7e-b271-e077a8bd49b6", "value": "T1C8431925AD792A26C5D8A57A61F78324F1F2224E22F4C61D3CB20E4EFF14B4069177B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646375, "uuid": "92ba2384-ee6b-4291-a8c1-ba4a435f570b", "value": "768:IAoXn1uK6lV6l4tPzoq9FLns7nI/wLc9sv44/7ffTRx6UOrfA9vPPxO+awYh:IAvtPzoSFLns7nII4O5/7fTX6OPBC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764646375, "uuid": "df4f56e8-ddab-4789-b46c-53db661eceb6", "value": 59316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764646375, "uuid": "c5dda231-d98c-415c-b01a-aa842d635754", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646375, "uuid": "ffe620e9-daf8-4880-b761-ea735d5e3e4b", "value": "3atoNational.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2243a39-cfc3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764710013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764710013, "uuid": "d1916e15-69a6-4bbc-b67a-2ccb10c698c1", "comment": "Malware payload", "value": "c886d3941210d0a7ce625e4d7be89c1a", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764710013, "uuid": "2bf91b14-9010-4147-b178-efb83d9f752e", "comment": "Malware payload", "value": "0250018eacc1b013e1b4264175491df348dd0b5bec7a1a80f0555a52d2be3aa1", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764710013, "uuid": "dea28f01-4e6b-4735-9768-9067440fe5fa", "comment": "Malware payload", "value": "0e6dadeb64dfd43d8cc8fbd786f753f92bf523a1", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764710013, "uuid": "04ab968e-bfb2-48d0-a76c-dd229875d449", "comment": "Malware payload", "value": "a4544482293598f12f584914632fad8a6183f56ba34fb719d848170dac56fb2d52757cb2ecf62897815ade26e7a7209e", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764710013, "uuid": "3fc3dc6f-7d54-4b38-b529-e6c0daf2be54", "value": "T113724F353D9AB404967EE51AE22FA316FC69344BEC109C8335D339972A033D569C35BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764710013, "uuid": "f13356ac-49d0-4677-8f2d-178eba08b2f8", "value": "384:VOLgInpEb3egcNMziLVT5emZpT72qfKsXdo3/NFoZUsQI:g1pEb3NYLVtfJN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764710013, "uuid": "6643c092-9885-490a-bb87-68ce1031fe19", "value": 17309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764710013, "uuid": "5da56fb2-b225-4d42-9568-891e946936b1", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764710013, "uuid": "680261c0-a038-4ff0-94c6-c6fd34f5cc16", "value": "dtxa.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5670128-cfa3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764696221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696221, "uuid": "243595ac-0f98-47cf-b888-0d7235ea57b0", "comment": "Malware payload (Mirai)", "value": "f7614c44ca9309cd6e8e291280fdf1c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696221, "uuid": "cefb514e-f2e4-4840-a16d-9e14e135dc1e", "comment": "Malware payload (Mirai)", "value": "0259864d33c9763d4c44b2448c2cb7ea50d3b41f4b878a79bf5e840ae8d3df32", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696221, "uuid": "47b8c354-e428-4bde-a0d8-547f57763813", "comment": "Malware payload (Mirai)", "value": "47badd1b0476392323d0603daf4ffc24b581e685", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696221, "uuid": "49c6a09a-9df0-4e38-8624-1867a9902804", "comment": "Malware payload (Mirai)", "value": "caf56cf988778eb5bc25802c8f4024f9cbad59d1bdc3d11d6abc9370c99e81d79a010a1752e2d2ef8022ca04a561791e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696221, "uuid": "8092a49a-8354-4bf6-81f2-2763dbac0358", "value": "T18CA30805B9819F12D4C621BAFAAF414933136FBCE3FA7101DD20AF6427CA9DB0E76512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696221, "uuid": "90236c5c-ddff-4255-9989-0f2e508bf63f", "value": "3072:4Ei3Sbr5qJljay/rvWWDvL/cDXhlpQbub:4v3kYjjay/rvWWbLuXvpQbub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764696221, "uuid": "3d001c5c-411b-4c71-be6f-5bed8a639623", "value": 100084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764696221, "uuid": "ef680a65-5a63-4f44-a38c-d9a2b6dcdf38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696221, "uuid": "630e50ae-4702-4208-9f67-c0b19f1dc879", "value": "nsharm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0ac8a50-cf26-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764642552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764642552, "uuid": "29c1d000-b6a7-4ba6-90d7-5cd9e1d78ba4", "comment": "Malware payload", "value": "132ff54209fe48e859d8272e13baab7b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764642552, "uuid": "2a185d7b-424f-4918-998c-98f7a68372a5", "comment": "Malware payload", "value": "025a2ea99c744bdd7f50aaf28f1259df094dfaeac1660ab5843fb5f1af71e6de", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764642552, "uuid": "30cc5ca1-3758-4b7c-a709-638509730426", "comment": "Malware payload", "value": "2943041aa91d4e191ee2428554c39a610af4101f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764642552, "uuid": "82628c2a-21d2-4381-8b61-96708ff3cb5f", "comment": "Malware payload", "value": "cda6045f7de0259b57b209989b2a9243f871c3327f648f6fa16de6e48ccf06dba06afcc5b4937d4b676750c40eb99a6c", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764642552, "uuid": "2e0932ba-ea70-40f7-8fa2-6bb5c46ee7e8", "value": "T17E18337B6F8FC9175664E6B139DF85C18D0B1FABB5C198E34BCCCEB98661580482F284", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764642552, "uuid": "602d8bc3-83a6-42e1-a52d-16275ab1a74a", "value": "1572864:FJSSJ+zfcsgeyB0+fgkSTjg8p3Jk+4WY2buifoQXVFR4pw:CSsEVNkgim8QKVf4pw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764642552, "uuid": "eb533f0c-b747-49c0-9abb-8191f4418933", "value": 87791828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764642552, "uuid": "35ec10d2-e29e-49b1-b31c-5fb178e98f2d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764642552, "uuid": "9c70bf5f-d928-4a00-99ee-d8c98b1a3615", "value": "LauncherOrigenSouls-2.1.0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ba7faab-cf2f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764646248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646248, "uuid": "48ab7f17-b51f-46d4-9990-75204a458b13", "comment": "Malware payload (Mirai)", "value": "05dade50b774d8063c10a15ea1679737", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646248, "uuid": "6f2ac275-35ee-4b51-9096-06d79ca4fdc1", "comment": "Malware payload (Mirai)", "value": "02dc465971f56cbd5f695e5d45ae239fff0de09415d36409312c2f1bfd43e6ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646248, "uuid": "8650ff90-f5cb-490f-93a8-b508dfbdf910", "comment": "Malware payload (Mirai)", "value": "363e79b4b11fd5c487d27ce21f46787bb3723347", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646248, "uuid": "df968656-726c-4245-bb51-3bb5cb45a34f", "comment": "Malware payload (Mirai)", "value": "71085c8a6ed545f418a40488d9aa276df3fb314be75b2c26fe306c805343fb7a9733a2119e58a56317a474a62b088fcd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646248, "uuid": "4025cf77-0665-4f1c-931a-f33b24ff7846", "value": "T14143D652B8815A6BC1E423BBEA6E518D3371B3F8D1DF3616CC111B24778952F0EA7B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646248, "uuid": "3f555243-b0ab-4b53-be11-36e2958ecf0b", "value": "1536:Jk48ZOlDxbcYfiQ125+XDW+rd8ea0ClG9WkQxEd42+:x8ZKut4DW+iea0OG9/QC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764646248, "uuid": "92158eea-620f-4016-9470-e8a70a3d7f32", "value": 55612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764646248, "uuid": "96b63a32-82eb-4d60-9c00-91df10e778a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646248, "uuid": "2e65da6b-03d0-4d40-8b17-16faffa198d1", "value": "jew.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c6c6371-cf90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764687991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764687991, "uuid": "6b160d2c-50ee-4cb5-bec8-5f10d2476fa5", "comment": "Malware payload (Mirai)", "value": "3058edf8f50ebee8e3d61b5028759e4c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764687991, "uuid": "954753ee-48f3-4882-b29e-a8c22b9cbb66", "comment": "Malware payload (Mirai)", "value": "03ecfe746094ad49858e63c7bcee4798fa5d65d93760d561121bcddada9f0b05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764687991, "uuid": "a36008c4-f433-4c04-8aab-39641b77001f", "comment": "Malware payload (Mirai)", "value": "0eebc7dc0fbc98af1d2b7fe69011cdaa8633dc26", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764687991, "uuid": "1a3a0a06-1b6e-4865-af8d-3266c4df29ea", "comment": "Malware payload (Mirai)", "value": "e85c802f301d2dcba4ffe80a9dbfa66cd57aef723f90866c768a4fc0d92b5862bb6410ce4de8f35f9456376e08b8b0ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764687991, "uuid": "24293e48-9209-46db-ae16-7c9724554593", "value": "T1F5A2D121E0B423DACEFEAD70FF59D16B2EB56FC961A58ED12201E7612D035356B142C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764687991, "uuid": "c81ae872-b46f-4608-9edd-700e162e4375", "value": "384:i8x9GD8sGohMIVOZ5PbQcKk1rNamdifZd4b7sNDWMV9FidmMUXTM4uVcqgw05VxC:iRYssZ5D/KmYu7EDWMV2E7A4uVcqgw0Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764687991, "uuid": "33956277-84e6-4bd4-9a39-1ee46251baaa", "value": 23040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764687991, "uuid": "20a79909-36cb-4d3a-8d31-5b073bd998b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764687991, "uuid": "b91f0e16-2760-473a-ad1e-0508f23d3a84", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46a50438-cf97-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764690908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764690908, "uuid": "b6ee42e9-95e3-4f66-a158-0be98297cbcc", "comment": "Malware payload (Mirai)", "value": "28db3b009cb693fc6c113e74770f0968", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764690908, "uuid": "f6e8de73-a502-419d-ba37-e23ca86765c1", "comment": "Malware payload (Mirai)", "value": "04545e530e7987cc6fa2a34f1d50834523dc78a29f7dc0bab6bb201cfbfb2a46", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764690908, "uuid": "7313bfd3-3c8e-40e7-9de5-e8767374418b", "comment": "Malware payload (Mirai)", "value": "8a29c2685012b9f3d35c0dfab92f5e546cb095f6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764690908, "uuid": "dd6482b5-2c8e-426d-86bc-5b8f96093712", "comment": "Malware payload (Mirai)", "value": "218db94abf2c7d97e125bb71494a64fc52750fa87fcf603b0d9fcc9d88f99bd43dc86abc80c0b334188610e2d2badf05", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764690908, "uuid": "0b014ad2-bc82-45f6-b474-d767c1bb24dc", "value": "T157515BCAB3D24A30EFB15DDA75F580547080E0996BD3DE86E0FCA4BD494EF096490BA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764690908, "uuid": "0ff593db-b359-4e03-8470-3ccc989e70c6", "value": "48:vXa+aYaOa0aUpzEa7agaVaSaKaYqUfaLa+d:vXa+aYaOa0a0Ea7agaVaSaKaYqUfaLaQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764690908, "uuid": "7acfd8da-6696-4141-b719-bb8c15cfb65d", "value": 2807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764690908, "uuid": "2ce23224-f572-4b4a-8a95-04ba390f404f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764690908, "uuid": "a68a5219-e396-4bdc-8ee7-b1b9612b9f8a", "value": "aws", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac6d43b3-cf48-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764657148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657148, "uuid": "afbdedac-c192-4142-b9ec-6e0ceaf76059", "comment": "Malware payload (Mirai)", "value": "3c9bb792695476b762f7fff46181297d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657148, "uuid": "f9250aa8-d0c0-41a6-94d2-b5eee6ec0880", "comment": "Malware payload (Mirai)", "value": "04917c1d6b6a26686bee2e2df962e4296236e01610d4e39c74db35e520471770", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657148, "uuid": "0af73500-1988-449b-86b8-ad78a3ec2394", "comment": "Malware payload (Mirai)", "value": "d17943302298a210b900daf58242e31646782f25", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657148, "uuid": "0db99ba5-20c2-4ef4-a258-6f9dc4f9f870", "comment": "Malware payload (Mirai)", "value": "fafbabb4444085a96d8b9da2688c5ae9731ab4710adcf419777e428a85e0655e0a1091578d1ffd5cc88cb63547e93aec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657148, "uuid": "376bfcd3-d327-4969-878a-beca5e5d1e71", "value": "T149933966F880DB16C6D4267AFB9E118C332217B8C2CE7106DD149E3577EBD5A0B7B602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657148, "uuid": "d2f817cd-e92b-45e3-957c-2bc594f63e0b", "value": "1536:TvaS2aYhjPjYcZ6pxzFU0PjtSt0aHBl42ux5WX8zdafO9adhWAfyZD1901zvtx0k:T52xPMx60PjtSt0wBqr5WGjwdhFyNkzt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764657148, "uuid": "b33a84e1-6887-44e0-b7d2-3b6f3a6f8c90", "value": 95544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764657148, "uuid": "31df07de-d8e3-4a25-99fa-e4262242f6ec", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657148, "uuid": "fa371b5e-b404-4015-9258-0ca6f4b1865e", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0794b61d-cf71-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764674481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764674481, "uuid": "7e796c40-f5f9-433e-8324-99abe54c44d0", "comment": "Malware payload (Mirai)", "value": "04bf53ff8c2d672a124a258120ab516f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764674481, "uuid": "e4e03f62-253f-4f14-b77a-26c9ae21031b", "comment": "Malware payload (Mirai)", "value": "04e5a588df2f800e1e4c362c5b7b8d95e8aea5362a3a019a9f9e91f06e0b5b93", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764674481, "uuid": "c052edd6-9d1d-478a-a5e5-194c72816a55", "comment": "Malware payload (Mirai)", "value": "9a5ba7a3132e70d497e7cc85bdafcc986c255498", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764674481, "uuid": "b591d001-5b2b-49ba-a3b8-25bd00d5712d", "comment": "Malware payload (Mirai)", "value": "09cd00c2b7900ea302904ec3d874d000adecf1ae8d88b2e72379caa089572bbaf227812283e3060e7741cdf459ff35f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764674481, "uuid": "7944c4c6-ee88-45e2-a634-07e425c6f889", "value": "T187443B46EA819E23C0C11776FAAF4146333297E5D3D772068E286FF43BC7A5A0E63645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764674481, "uuid": "0374d9b7-ab4e-43d4-b41c-b789e8fed0e4", "value": "6144:qPLR+me2wdJYMi5AP2aI9tenY0eu34//elFnAOvMWKRM/9zra/ZmdwX+Bnr5Z3:qPLR+meBdJnkE2aatenY0eu3gmvP6W/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764674481, "uuid": "a0882f31-b9f2-4076-8951-77b335ccfc5c", "value": 274014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764674481, "uuid": "ed91c952-1104-4897-96b0-45e04e07a4b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764674481, "uuid": "686729cf-dd97-488e-ac72-45659ee976a1", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae6b522a-cf48-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764657151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657151, "uuid": "e94e8201-cfff-442d-90a8-e7190b041c42", "comment": "Malware payload (Mirai)", "value": "e25df761d6c2254a53de72cfe7c178c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657151, "uuid": "724f713d-8dd1-4291-ae65-258124f41d93", "comment": "Malware payload (Mirai)", "value": "060cda4fec2578aa61cdbe310f65b0a4fe244eee6a8b15305c884be87bc4e599", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657151, "uuid": "240f77b4-1a1b-4e42-bce9-e4d63b39472c", "comment": "Malware payload (Mirai)", "value": "d4a727fc269c1be5b4948c7b7afb4ee78b5197a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657151, "uuid": "94e62dd4-8b9a-49ed-8785-0bf09e476c06", "comment": "Malware payload (Mirai)", "value": "235c99cb87c627bd8fdac9152fa11e33448f639d193b6309073a1764d54f6cc63d78d5356a61795f9a29d9b058bb2ba0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657151, "uuid": "31e0d4cb-0ad3-4293-b912-d6c4d435a052", "value": "T1C3E3094BB7208F90D366C23009F74B66ABE5169227D29846E22CCD507F593AC785FFD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657151, "uuid": "4e9179f8-7d70-4c4f-95a9-9843ce8b7a89", "value": "3072:VKYWWt2MWkOBvJIC3DK59kBQFlNa6jlQvR/nRmQv2VC0O5j67oUPOUPjEGo:VKYkMyBvJIC3DK59kBQFlNa6B4ngQuKd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764657151, "uuid": "d4589ea3-34fc-4293-971b-e36c44daa50c", "value": 143088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764657151, "uuid": "51df8127-cb93-4817-8806-c689136b2695", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657151, "uuid": "1b42eeea-a0a9-4b90-9cfd-0bb7155981a0", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "939c7caf-cf2f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764646369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646369, "uuid": "1b15ee87-548f-419c-8c7e-7246e058221e", "comment": "Malware payload (Mirai)", "value": "aa92e2e083f083328022da1007e6907e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646369, "uuid": "72e27e0b-5d3e-4df8-af4e-e74862caf5b1", "comment": "Malware payload (Mirai)", "value": "064c0d71a5e973ca66a1ed4951d2053edd6d4740a3fd79b66b248cb001b2ab48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646369, "uuid": "876dadac-7906-4bf4-824a-48266d869ff5", "comment": "Malware payload (Mirai)", "value": "71b07e6c6bff526d7be9a1920112150209654699", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646369, "uuid": "df7c667c-5c31-43e3-bd00-58b97b9d3b19", "comment": "Malware payload (Mirai)", "value": "1c886e9d3699741ff8dd0c0bd28fdf740f652cd5c381b2cc6b08b610ef0dee8cb6f85a4df97408c1d191feb0ff2682d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646369, "uuid": "838cb076-6685-4c66-8573-475da3a2455c", "value": "T1DD63A406BF614FB7E86FED3709E91705249C551B21A97B3ABE30D818F60B25F19E3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646369, "uuid": "576929e1-69f4-4bbe-9833-8807143575ed", "value": "1536:3ic5mAk09wobL0JPNuBS9cb3polf+FXaU:3P5rSKIJPNRD+F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764646369, "uuid": "be58b215-1411-49ff-9a4e-fde3aba0651b", "value": 71508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764646369, "uuid": "bba193f8-77d0-4909-8682-f6362cb820c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646369, "uuid": "ea64e947-21bf-49ba-a79c-15e9eb5686c4", "value": "3atoNational.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "119bae30-cfbb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764706280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764706280, "uuid": "bd651d8f-5a96-4999-8fad-227686e387d2", "comment": "Malware payload", "value": "73461852b4794ef2dda4a8c4737ef648", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "s", "colour": "#C623EA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "soft", "colour": "#7A0DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764706280, "uuid": "34935cdd-7b98-4074-a116-577db1dbbb98", "comment": "Malware payload", "value": "0840c187a069602ded0ba48d42ada499a81409cd6492191c247af9637e80b6f0", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "s", "colour": "#C623EA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "soft", "colour": "#7A0DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764706280, "uuid": "0805b2fb-c1d0-4cf1-b1f8-1c94c0dfd42e", "comment": "Malware payload", "value": "27015c7c45876ff15c33bf0e0db9e34a6e71804e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "s", "colour": "#C623EA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "soft", "colour": "#7A0DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764706280, "uuid": "75f996b7-3250-4073-a8d6-0a9a77f1aaa6", "comment": "Malware payload", "value": "90002b4f003c19c29f6dff10a477450f71bdf403ba42fb630ddd31131ec32f07470448d16c42fad086a77e6c6cc3a731", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "s", "colour": "#C623EA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "soft", "colour": "#7A0DF1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764706280, "uuid": "961d872d-9293-421b-8541-c9362a0e3c6d", "value": "T1FCE5338677EC5AB2D2A199340AD477B72D74CD561F02D6E399C00906ACA0BE1B2373DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764706280, "uuid": "872b9143-b5cd-41de-8b86-87af12a9d893", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764706280, "uuid": "e4b42c45-f95f-41dd-b538-f13b08a6a18e", "value": "49152:ls5aU11jSas2bmzLEOZL+19l4cc+fxHiwq4hvA+2ODZl8tgHknr:ls5a8ptUBW9li+fxHijz+2UZl8gYr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764706280, "uuid": "bde010da-7241-4ff9-a8ce-e8c34700ca2f", "value": 3151944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764706280, "uuid": "24b49915-2fb5-4cf1-b022-a46e539e6092", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764706280, "uuid": "ea6d5f15-f55b-4f7d-9bc8-72dd77610397", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c4611b8-cf58-11f0-a129-42010a9c0007", "comment": "Malware payload (LummaStealer)", "timestamp": 1764663993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764663993, "uuid": "1b738d98-d383-45a9-916b-74f75c479013", "comment": "Malware payload (LummaStealer)", "value": "2b45990bd39fc06e95e963b4a0b8a657", "object_relation": "md5", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764663993, "uuid": "9151190f-2da4-43af-bedf-93d4cb3d641f", "comment": "Malware payload (LummaStealer)", "value": "086cec1ecde1652d9c2384862e05daad41ee562b623a7e2cdc4f681d6d14aaa0", "object_relation": "sha256", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764663993, "uuid": "5f2164f4-0687-4700-8cd3-82cedb7043c6", "comment": "Malware payload (LummaStealer)", "value": "ca5b664f0002f8e64ede277db83c58ae0d8e9415", "object_relation": "sha1", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764663993, "uuid": "d4a22580-9d53-4fe4-87c7-a0a344c7e6ab", "comment": "Malware payload (LummaStealer)", "value": "81af00211543dc714a12e8f8ae923b24766f0ad7ce8b5a1a65b408f4d74a8476e505984ea8220ad94b6ac372eed894cd", "object_relation": "sha3-384", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764663993, "uuid": "ef4ba412-c21c-45b9-8e56-20cfeed187d0", "value": "T1FF3633A296786212AE4AEC640663CECDF192C9FF35C6516D975F003FF20F24775AA309", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764663993, "uuid": "1379b5c7-31ba-4fcd-80d1-e2099cb6784e", "value": "98304:9o6XXr0UBp7464RlKLujVDRKHyu7Dx1bEGi3h+OEFcGFyjoI1P0lLnAScU:i6rB70eSeSuXPIGgEFLFyjNsLn5cU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764663993, "uuid": "2f3932f2-857f-4673-81e2-95489f002fe9", "value": 5340172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764663993, "uuid": "9a8a1487-9144-43e4-9201-5805cc44e5c6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764663993, "uuid": "574d1509-4a64-4763-b8a6-551eef5d68de", "value": "genix-windows-386-v1.1.0.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adbd29c4-cf48-11f0-a129-42010a9c0007", "comment": "Malware payload (AISURU)", "timestamp": 1764657150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657150, "uuid": "f9f653bc-ce4a-408b-b48f-f48607cbcba5", "comment": "Malware payload (AISURU)", "value": "534465d39f953ef8c0d49bc9831caf89", "object_relation": "md5", "Tag": [ { "name": "aisuru", "colour": "#B49DAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657150, "uuid": "2c2c4b17-3695-490b-819e-44b37dadae20", "comment": "Malware payload (AISURU)", "value": "0a126b90236c407cf2eb703c1fcd00d2539b6a0c830697ac877f012436fbdfff", "object_relation": "sha256", "Tag": [ { "name": "aisuru", "colour": "#B49DAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657150, "uuid": "24be2cd8-dd09-45c4-97d0-a3992bef2596", "comment": "Malware payload (AISURU)", "value": "7313648d2329ff8230362c1ec83168bf0723b46f", "object_relation": "sha1", "Tag": [ { "name": "aisuru", "colour": "#B49DAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657150, "uuid": "4bc7d80c-15aa-48d6-828a-d72f3f1d03b6", "comment": "Malware payload (AISURU)", "value": "14bc4bd4c01015827ce9a8fb1a06d4d14138e3a9ff10c5675fdfb7b7d35e72b7b0d21bc4326deaf9cb87c3ffe90f8451", "object_relation": "sha3-384", "Tag": [ { "name": "aisuru", "colour": "#B49DAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657150, "uuid": "71ac8f2f-060d-4956-81a7-cedeccd8ace1", "value": "T198D37D83B7865F62C26656B20EE2873DAEDA234206B3C86BD3765E0103571F57C6DEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657150, "uuid": "e6a83620-94ec-4bd2-b7b6-a0b23f3c3568", "value": "3072:1wMfCA+/U6jMnlz0qUmq70ckhwLMxMRw1qg8I9iF2MOjcJFBF6:SAgjMlQ7kIMCwqru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764657150, "uuid": "383639ed-ecfe-4e7e-8fce-79742b4a4aef", "value": 138480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764657150, "uuid": "8f9d58ee-dc5a-4436-a7f8-29976fbafcaf", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657150, "uuid": "34b58908-d21d-418e-a15f-b4ffffac2e03", "value": "mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56edd41a-cf97-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764690935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764690935, "uuid": "b172e84c-8c51-4eba-aafe-a3a430c0e1cc", "comment": "Malware payload (Mirai)", "value": "54d1d3c3aaee710c59bc59295e2ea0fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764690935, "uuid": "07a71beb-b955-41f1-a3a4-6a2e9d8f6f49", "comment": "Malware payload (Mirai)", "value": "0af1b3ed6af1155abb64810094dde36fa9c12096b67e4267a92370f9817cba19", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764690935, "uuid": "bc3d9a0b-cbe1-47d9-b456-606e3c792aa8", "comment": "Malware payload (Mirai)", "value": "d3b28ff3cfba307bbb20bfd59dae12090a2f9bdb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764690935, "uuid": "537c2c38-1f8f-40db-a915-be828ce54e65", "comment": "Malware payload (Mirai)", "value": "d6ff2849be68ce87647639e1ce3a682c92735a092d15e09c377f884f25395a1f843631067144e91116244a8aa7d3ed8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764690935, "uuid": "20e12d45-6944-4027-9cec-2a79c35e73b4", "value": "T10D343980F687C1F6D81389305097FF3F9A328866C076D65DEF98AF36DA67601422639D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764690935, "uuid": "eaa24666-07eb-4ec7-a6b2-e4311ece5f68", "value": "6144:OtbivhLjhTMx3GKGwW8f858hGNkUsytykKEYkJ:Moljhwx3tGN8f858dgp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764690935, "uuid": "e3633939-f67b-40e3-a95f-ea22a9c6277d", "value": 232040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764690935, "uuid": "2e421908-b8bb-4175-a8a6-a2d83ee9bfca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764690935, "uuid": "19832143-81eb-408c-b716-74cce8c8382e", "value": "ecco.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae452ed5-cfda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764719858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764719858, "uuid": "34cc6750-bef0-4445-ad70-45f1c7ea1cac", "comment": "Malware payload", "value": "461a6c5fcd18251f3a2a72fa6934a77f", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EUNIQ.file", "colour": "#B55256", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764719858, "uuid": "f78eea78-ac1e-4f1b-ac7e-4486dc02315c", "comment": "Malware payload", "value": "0b1191308b4959156fd6bb25fb0ed91b22d9591b14f8307b85b1c11b2ed4bdf9", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EUNIQ.file", "colour": "#B55256", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764719858, "uuid": "e94689de-2d0e-4e82-b6d1-fc2be2b157be", "comment": "Malware payload", "value": "1612208620a5b594184e8e54437d7367dbd2aeb4", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EUNIQ.file", "colour": "#B55256", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764719858, "uuid": "f5d4247a-8939-4586-b0d7-b5057c0f5f79", "comment": "Malware payload", "value": "f7515ae6e59be8deb614307bf89d5941e5c212673de22af6cd2c57eb49bcb9bf7357f08974ba8f777496019e10eabfa2", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EUNIQ.file", "colour": "#B55256", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764719858, "uuid": "f67a133a-c988-4a4a-9147-ba6efe2d3f3a", "value": "T1ADF5F123B28A633EE06E5B3749B2D2205D3B7A61A51E8C579AE40C4CCF5E0A01D7F757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764719858, "uuid": "97e02fed-2f7c-4842-a830-037feadc41e2", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764719858, "uuid": "414f9dab-d503-4783-8df9-31bc127da173", "value": "49152:XN61T1mWISb4lpzVwUfSTOWoE6gwxmQcoQnQumZObP5eQ9tXDwEwiCZ4TYHx2pB:XN66rSQsUiO9EkcoxbAPMQvkEwiTy2z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764719858, "uuid": "53f6e45a-319c-44d3-a98f-aada88701415", "value": 3422320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764719858, "uuid": "a815d4ac-ade8-4a17-a392-9800aa936eb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764719858, "uuid": "24ea8089-7a52-49c1-ab5d-81abaab95f2e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98df58cb-cf2f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764646378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646378, "uuid": "46d7a3ff-b656-446d-87b7-eff358ed86d8", "comment": "Malware payload (Mirai)", "value": "79a69f9daff8540c6e5aa06b7604da4a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646378, "uuid": "4e2b882c-95a4-47c1-bf4f-0a446ea19d94", "comment": "Malware payload (Mirai)", "value": "0cbbdf2de108fd08230699f42ac34707a889661f58a8a5643fe0f4547916c4ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646378, "uuid": "8db857c8-8195-4345-b057-f6824fb9ace9", "comment": "Malware payload (Mirai)", "value": "bcb02156110e0ea1fcf963603376906ac0630b67", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646378, "uuid": "0b063a0c-47db-4426-8af2-97ce100188e4", "comment": "Malware payload (Mirai)", "value": "8749f9d2fb4e2c84839814b1bd0623330882882d66922a679933cda9883c51fc006b756052d9c04a95bae43ca3102bfe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646378, "uuid": "4a7bea4c-409e-4fad-9d07-70fa930a7b79", "value": "T19C3329DAF9029E7DF88FD6BA80674E09F631221041830B267777FDD37E321949952E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646378, "uuid": "f5e20ced-17a4-4068-a107-82c6d017ed4a", "value": "768:TaeKdnuq3yaHFpeLAMpyeTLRDraguR7mwGJRytw9cDdEY8muZ:mfdn33y++DuBmBRytwCDd987", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764646378, "uuid": "59355319-cc87-400e-afb5-532529ccbc44", "value": 51956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764646378, "uuid": "f222ebe9-7608-44f4-89d1-a52040065b32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646378, "uuid": "10dd9573-3f75-4dba-8b82-395b03fc3198", "value": "3atoNational.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c0be998-cf9b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764692742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764692742, "uuid": "0c3037f8-736d-4fe4-a706-702c88d6df45", "comment": "Malware payload (Mirai)", "value": "33211d9e6169cc8f56bc09cff2c3e618", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764692742, "uuid": "8ebd3ef7-7bbb-446b-89a2-4ce1368f8f5c", "comment": "Malware payload (Mirai)", "value": "0d00e221da4f06c72511d776d3e3ce84925e23b2cebedc1c8ecff6a3dd716bb7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764692742, "uuid": "d0265674-5a98-444e-a16a-68d2648ae22c", "comment": "Malware payload (Mirai)", "value": "c06f536fedc7d4f3881ef1506989f17c458d8b60", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764692742, "uuid": "4daf4df3-1172-4ddc-9cf2-ad8548733d06", "comment": "Malware payload (Mirai)", "value": "81c77292c22123cca164366889677a28f595d3b4ea8ea31dbd6e1b3b30b375a6415c5267007228c715eb3159be1ef145", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764692742, "uuid": "94f48e25-4b97-448b-b984-d9543395bd23", "value": "T1868302416E3CF41491A4DD35C4AF8E8BB72B5BF1C0EB78261AD213B0E57A68658ED7C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764692742, "uuid": "3413f5b5-3bfc-40d9-8482-ad5a63bdb1aa", "value": "1536:74kuoYJLbcnRm3pGg/DNRdmivkDMl33oZ4lXG4+U2NMEMsTnEFAtPwb0d8wLe:UAYxgnVodmivXpY4l24+UpnsTnZw0dN6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764692742, "uuid": "704a06f0-cc6f-4e45-8274-9d0bbd43fdba", "value": 88292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764692742, "uuid": "f4197fdc-8b5c-45b4-a14a-e7c600256a6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764692742, "uuid": "ea3ed232-04c4-4107-912a-9e0b1fa9e869", "value": "SecuriteInfo.com.Linux.Siggen.9999.24892.13666", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11a97377-cf49-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764657318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657318, "uuid": "c2d7524a-56f3-4677-bdf9-59ead3d125b3", "comment": "Malware payload (Mirai)", "value": "6e2d7ddfd04bdef3dc498ee851cd88b1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657318, "uuid": "cf640af5-4265-4c3f-a419-050b5079dcb7", "comment": "Malware payload (Mirai)", "value": "0f6afd764aede16b1e82203f2f9588993170a5bb1ec30b89cb81567172e53ad8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657318, "uuid": "5402e108-27bf-4239-be0c-ec43f45561b2", "comment": "Malware payload (Mirai)", "value": "056916f2d869b52f8ddfd00ccd354c71f4baf589", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657318, "uuid": "2271917c-22d3-42b9-8cec-732f349bb8d5", "comment": "Malware payload (Mirai)", "value": "5217ae3b2548333182dc774da5d37876adb894fa8f1a4e09ecf00490a729544e57973a9f03a5bcbf72e34240b14d2a24", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657318, "uuid": "dc5bc0e4-daa0-45ec-898d-a66bbb819cc2", "value": "T102F027CD92A2DC3158935CEBB12696199DC5C5C90B878EC064CD007BE0CCD0470A2D95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657318, "uuid": "610959f2-6ee7-4846-a3f7-58ea63b046c9", "value": "6:ebw73w5/KDbA4PZ9wWLZA9shGo94RNAcs2rFLf+03B0bUeEnuXSIy1bmxJnn:3WKDbnPZ95ZMoOF7+MB0LEYSIy1KxJnn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764657318, "uuid": "6b336297-79db-45b7-8146-717d1df26d25", "value": 458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764657318, "uuid": "37e35630-9377-4980-a767-022c94ad55c3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657318, "uuid": "36cc8997-2ecc-4098-b21d-bf6c0b5924bc", "value": "l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "905394d3-cf66-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1764669986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764669986, "uuid": "85bba76b-3cf5-4b6c-80a1-dd29caf9a09a", "comment": "Malware payload (Vidar)", "value": "a3707686bc1b7ed52f9a86f68cc1de70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764669986, "uuid": "1ee7cab4-2701-4994-9ca6-631d1b120544", "comment": "Malware payload (Vidar)", "value": "0fa64636b0b9f82665759aedc9a553e0a9b1c377823a350775fc8fb1a82df995", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764669986, "uuid": "93173de5-9efa-40ab-9b54-de4947202b96", "comment": "Malware payload (Vidar)", "value": "660af3cec90e1a4dbfff36cd93dce8be927b44f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764669986, "uuid": "fb08bc15-bb53-4bc2-be41-63db9335ca26", "comment": "Malware payload (Vidar)", "value": "a9bd93c57c7fd192976ad7e00ba00b012dfd1befb799845e21b07ccab89bc62bf83cd2296bdd00aed6224f38bd28fc23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764669986, "uuid": "1d4c83d2-8596-48cd-bd0c-2efb4b163687", "value": "T10B364B177991CA9AD09FD239B8933186B6B07C84077137D79A4026392E7E3C84EB7B5C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764669986, "uuid": "efaf7761-42fc-475b-84e6-9a1596068dac", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764669986, "uuid": "8c89a60b-7546-4c28-97d3-97a7b5ba018b", "value": "49152:iEO9nQEqYCLWINLE6h7YFZpwLdOAbnYPNCsJpktvAfzyeUw6pZeQ0x4fMnKAl+bn:insHWOMAqSzzy+Ay/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764669986, "uuid": "096dfea7-5cf1-441c-8956-88ea0dbefee7", "value": 4942472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764669986, "uuid": "0f28a168-50ee-4e74-acee-b7aa6bd249e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764669986, "uuid": "e61ad017-316d-4962-bf21-7c8bd86a06ab", "value": "ukmuqxxvdtmcmlcxjchm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fc691e9-cf5b-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1764665180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665180, "uuid": "cb3a0958-6802-498a-a532-b148bdb55bb7", "comment": "Malware payload (Formbook)", "value": "a1c76cbbe0841df5f479e4191cb3e239", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665180, "uuid": "aab2a00c-29fb-4c70-868d-790a9c18f907", "comment": "Malware payload (Formbook)", "value": "102efcd647e8331f4c9a8d980f3322640c1fd24d6dfc4173153094ca640ba0b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665180, "uuid": "07851784-b60f-49b9-8609-f8e1b98a46f7", "comment": "Malware payload (Formbook)", "value": "76c08a4d139b273081d0cf7db508133d93a18fd9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665180, "uuid": "a21faf5b-0f29-4d99-b8cb-0a193de1fd58", "comment": "Malware payload (Formbook)", "value": "b5948e58bcb42add5ad9052403e9815b5db3dabc15a6c0f00bf7a1de0b2cd8fd4559c66d9c00a104b2067dd751f307fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665180, "uuid": "40a1b0a9-2927-4966-9370-fc250f3919bb", "value": "T124E412693209D50BC46A1FF10875D1B22736AD9DDC22C19BAFD83F5FB8AAB584B05343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665180, "uuid": "b99b84bd-3d89-4c11-a967-7e3b47e2dd9c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665180, "uuid": "231a2151-b5cd-4770-9303-39cf4f6f58be", "value": "12288:W60BBCdnT53F2A9+LsnM9aQnBCwbnKA/xRjhKpKwFz2XdLd29C91WkYJ7NR70BB:0m9BAA9DQnB/IKuz2/2y4Nbw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764665180, "uuid": "1b6d9c69-2deb-4dff-84fc-5c7872ab588b", "value": 718848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764665180, "uuid": "80db93d2-61fa-4a39-a85c-32ac3d4ace66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665180, "uuid": "5e65b5e6-0623-495a-b1f4-1515b0611179", "value": "Quatation Inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a11c327-cf2f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764646380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646380, "uuid": "5d8d8a70-7e99-490a-a480-e93c6aaa6f30", "comment": "Malware payload", "value": "7f2176d06e69fd43e5477149414b3a12", "object_relation": "md5", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646380, "uuid": "ed67d4aa-dc4a-4394-aaa1-460b8a9f914e", "comment": "Malware payload", "value": "10b17062f1b24fd277f3f1cc879966b0153fef9341bbbfa23548965b2aa70a18", "object_relation": "sha256", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646380, "uuid": "fbaf73ce-aaef-451d-86c4-2948b17e4920", "comment": "Malware payload", "value": "483c6803401fb7c7a3db190edb06b59bfa9c1c01", "object_relation": "sha1", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646380, "uuid": "d5c7f06b-c0ae-4cdf-bf40-548cc5549b94", "comment": "Malware payload", "value": "8bfb361f43ca40fbfaac97f638f077a9324c537252806e6fd3760913385a055966da343a2e6649382edb6feef0fc9306", "object_relation": "sha3-384", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646380, "uuid": "e68e40d3-5434-44ad-8fbf-7bd6057a2bbd", "value": "T1ED0128CDA3ADCA510476C18BF2F68414C0B0C4D3A0E663C6F28D0DA79F298693913A0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646380, "uuid": "25b14bb2-3d2a-41c0-bd04-7b7cec9b6060", "value": "12:FH8ioNJAC7ukxGWi2jU30+0K5+A+ADj2nkV/1lkV/5uArZhG+E6:FH8j/wWi2jzQrVtSVr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764646380, "uuid": "13a772a8-e0bc-471a-b7e3-1bca25174517", "value": 785, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764646380, "uuid": "a14f3bcd-7c73-49c2-90cd-fe3af896c496", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646380, "uuid": "a04fb2c0-9a81-495a-8e63-fda7165e7604", "value": "o.xml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d6d7575-cf91-11f0-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1764688261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764688261, "uuid": "672b047a-f9d3-4cc1-81be-63a2e83b310f", "comment": "Malware payload (Joker)", "value": "c9123f2c44e76a76324a4bec8eba6164", "object_relation": "md5", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764688261, "uuid": "d56b0cd4-b042-434b-9888-1cc679cc800f", "comment": "Malware payload (Joker)", "value": "10bf1f5b8ff381be158d2b09ab285e3de3e23fc14ad43c82b46a84a9bf7fd7fb", "object_relation": "sha256", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764688261, "uuid": "4df61853-b1b4-4578-bdcb-aa00110a813b", "comment": "Malware payload (Joker)", "value": "587805ff0bde972c9a80eedc446495aed78b0590", "object_relation": "sha1", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764688261, "uuid": "91432c24-09a6-473c-9317-52ec4ce6ecee", "comment": "Malware payload (Joker)", "value": "a3383605b66d89e8d3e0a19eaf1dc0d75589a7cfd42aa655a0051bd08e5c9164081dedd0e7e718abdca56adee5b634b8", "object_relation": "sha3-384", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764688261, "uuid": "9bf4d8a1-8946-4d58-9194-75bb9ca20a80", "value": "T1ADA62246FB0CA02FCCF750364DA912722217AC964E52D7A77810735CA9B76D89F1AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764688261, "uuid": "759beb14-c502-4daa-843d-f6a2946704e6", "value": "196608:n1QoG4bUhjEz/U7BjhzVQg1fagC/m9rx3VpcF3edDREVVVaVBFnioeniO:mopYhgz8V/b12+ZxXceREnolnioeniO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764688261, "uuid": "b5bb4a77-3259-489f-95d3-2a2b73a516ee", "value": 10176075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764688261, "uuid": "adc2b3e9-6e6f-4b67-b324-f830c9b0ebc8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764688261, "uuid": "f76f7f3f-3136-4269-a12d-f060dc4e1c38", "value": "Cool+Live+Wallpaper_3.1.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3da8a81-cfa3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764696245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696245, "uuid": "f731deb6-124f-4bb9-b568-f6c5b0b3b4c4", "comment": "Malware payload (Mirai)", "value": "b364ffb1889d66d06161c732b3d530c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696245, "uuid": "769356f4-e476-4468-8fb3-978f4c31f6cf", "comment": "Malware payload (Mirai)", "value": "110d8c0b44f99313170f1c4deadbdcca14736c266f8a121fbc4eab57b8c0bac6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696245, "uuid": "a555b41f-29a2-4505-adf6-ca4ec490fb4d", "comment": "Malware payload (Mirai)", "value": "831e828b70a7d2c621bd73f1c2752af4a0e2e5c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696245, "uuid": "5325efc5-aafd-4c73-b877-4e82edf750fb", "comment": "Malware payload (Mirai)", "value": "7111619a4bca8ae18c47891fa1793fae6f40cfd4e3f47090e025bb46d501e7831311178cb49f0ac46d6aaa6a380513fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696245, "uuid": "b96bac38-99c7-454b-b710-645532edbc3f", "value": "T135E31945F8819B11D5D111BAFE1E128E37131B7CE2DE72029D24AF347B8A9BB0E3B516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696245, "uuid": "6d592355-acd3-4a2d-aa91-80f5daa3fb7c", "value": "3072:k9MtFSEJv0pXXmJy4aTR1fYzFQD1KuJacaQ2:k9GSEJeXWJvanMFQYuJapQ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764696245, "uuid": "4a05c966-9599-4e98-8464-65e63f8b213a", "value": 154268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764696245, "uuid": "55d38ad9-0bea-4dcf-b86c-1b3ca07d18e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696245, "uuid": "4d9a19cd-00f8-4d5e-8a47-881d267e4607", "value": "nshkarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50b6f9d8-cf2f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764646257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646257, "uuid": "5fb4e8fc-1947-4a4a-a73c-9ed451447169", "comment": "Malware payload (Mirai)", "value": "40a6b90657e2440afa563464c8167be4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646257, "uuid": "43f22d09-a8c0-443b-8052-273716c63c09", "comment": "Malware payload (Mirai)", "value": "1110798a017996cb750eb4195ad9943b3fd053a680a5a2d4d6151166f1b35531", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646257, "uuid": "0648c8a9-fda4-4395-8f3f-f713b6509dcc", "comment": "Malware payload (Mirai)", "value": "de6a3099b268411eaf5654942d2c70d3afc0f886", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646257, "uuid": "99866645-e549-4002-b085-d22ca26b18a4", "comment": "Malware payload (Mirai)", "value": "fc06b59321c1dc3066fae518388bcdd767955de9dd6a7bbf4b2210d12e76b2ac036b4580e2586af0bea2a2828c3a2e58", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646257, "uuid": "4cbdf4ae-0dda-4539-90ac-cbe1f422befe", "value": "T188337DB6C4E9BDB8D2049F74BD158A348B13A40086672EFEDA45C699C087DEDF2097F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646257, "uuid": "6c3ab15b-8fa4-4365-b1c5-2e1d790a81e5", "value": "768:Ca5oGwtR8WT5tRuRej8FriIkFsvKv5MJumtnnGCFodAEVC9:CaCGwtWx3T4v20mtnGpZVC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764646257, "uuid": "33843e44-e79f-48df-a614-ca8e5603a53e", "value": 50668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764646257, "uuid": "bf16da7d-f784-4c3a-ae57-e4612f8e3047", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646257, "uuid": "a32c02d1-15a8-4e39-b075-8d1f85e9f142", "value": "3atoNational.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6176285-cf5b-11f0-a129-42010a9c0007", "comment": "Malware payload (RedLineStealer)", "timestamp": 1764665325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665325, "uuid": "5fc99d97-3829-4021-a69b-f32cb9fa07e9", "comment": "Malware payload (RedLineStealer)", "value": "b7faf6deed94ed572cd0b893ebd043d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665325, "uuid": "b3a880c3-2186-4f09-93bb-68ec43f4b303", "comment": "Malware payload (RedLineStealer)", "value": "112699f3eed96b2dfb176b880f3be86ea083431600aeb889cd3ef46607caf4f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665325, "uuid": "243a5c78-09fc-4068-88a2-734b81e00d82", "comment": "Malware payload (RedLineStealer)", "value": "35b8c513f6dc2aed43a69e3032d1bffcddda0ece", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665325, "uuid": "1957ec39-2603-4084-80b6-cc53caf48d57", "comment": "Malware payload (RedLineStealer)", "value": "a3673a4cbed6461c8f1c60eb83d36721437f33793617587e0ab5ae958c0e1c57677e9083eda73115bf4286080d23636a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665325, "uuid": "033aee9f-0c2d-473b-91e5-ca5812854c40", "value": "T18C45BE0273C1D062FFAB92334B56F6115BBC79260123A62F13981D7ABE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665325, "uuid": "335b1eb5-9a66-4de4-a66a-ba47e1bfcbbc", "value": "c1ce208b1192bfcf652c179f34f034d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665325, "uuid": "5a2ff975-0600-4c1e-a710-f247a914a271", "value": "24576:S5EmXFtKaL4/oFe5T9yyXYfP1MAXDz5XnSMZO:SPVt/LZeJbInGiz5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764665325, "uuid": "12974c3e-d618-4ae7-93a9-9b1d2d200b98", "value": 1200128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764665325, "uuid": "516b7a08-b12e-4e87-a899-de48aca66734", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665325, "uuid": "2fabfecd-7ea7-4cf0-a1b5-4283470c74dc", "value": "PO_ASQT2510153810.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10d226e9-cf49-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764657317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657317, "uuid": "8a0702db-b826-401b-91af-bd8755f141a1", "comment": "Malware payload (Mirai)", "value": "13bde89f2f09b0caa9bb2b1c798444f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657317, "uuid": "3e74f8f2-ae3c-43ef-a8f5-96d943afcff2", "comment": "Malware payload (Mirai)", "value": "1162ecbaa2def9d221f332f85cfac52497129a15c27a104644d681bc4356909d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657317, "uuid": "0e23dba9-fd8f-47c2-9ec7-fbac5126e1d5", "comment": "Malware payload (Mirai)", "value": "d6279fc0f331e63972b28136f39d32b841408ed8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657317, "uuid": "3aaa90ee-069f-49d8-b496-de6cae3677ed", "comment": "Malware payload (Mirai)", "value": "f19fbea84ddaf95f34da0e51856498fbeece746c1222250d3af326f9c97a913048a831b79be797f73e25c3f91023c54f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657317, "uuid": "6c83b463-8727-4be0-8489-64aa1129fc99", "value": "T1B0E3094BB7208F90D366C23009F78B66ABE5169227D29846E22CCD507F593AC785FFD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657317, "uuid": "6a3d20af-2754-4e64-bb89-d0f7ec0df412", "value": "3072:VKYWWt2MWkWfJIC3DK59kBQFlNa6jlQvR/nRmQn2VC0O5j67oUPOUrjEGo:VKYkMqfJIC3DK59kBQFlNa6B4ngQ2K5f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764657317, "uuid": "f9b4ca61-1cbe-482b-8b99-54056bbc82ae", "value": 143088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764657317, "uuid": "4e79aba9-78c4-442b-bfe6-133dd4ac5a6b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657317, "uuid": "248883fb-a680-4761-b8d3-1d10659de756", "value": "sppmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae543094-cfa3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764696235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696235, "uuid": "a503410e-d1a5-431c-a0ac-f19ea4f19139", "comment": "Malware payload (Mirai)", "value": "c73575a9641c687b96cf237f267bdea2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696235, "uuid": "98a252b5-9b2a-401a-ace4-1790759b7ca3", "comment": "Malware payload (Mirai)", "value": "121ab6dff6c5a123daf34a82fc08dfe40320f0ce1643584e0f2caa85185622ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696235, "uuid": "e0c99a3f-8e77-44f2-a4b9-0050aabe92b9", "comment": "Malware payload (Mirai)", "value": "4d4b61454ff5840ef247e3bed8db71b17bbde1f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696235, "uuid": "63f12c3c-7daf-43fa-8a65-b07cedf54997", "comment": "Malware payload (Mirai)", "value": "3e0797693e25482ad8e187723fc9436796a3fe1587884b3d356b2986f421c38a5a996bc5788380e1923563fd1005862c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696235, "uuid": "0eeabcdb-2e51-4af5-99cc-f68b78c1b23b", "value": "T145C35AB3CC3A6E58D624D1B4B471AF792753A951814B2FBE2977C2B48043D8DF9063B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696235, "uuid": "cffea71b-8a8d-4e86-bb76-eb893a486d9b", "value": "3072:J3MRLuA0avQDWztHKMrjKtIWx2l2/TdBEi:J6uA0aoDWzt5uRx28pBEi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764696235, "uuid": "afbfc3b1-bfca-42bf-9924-c0b6a904032d", "value": 129700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764696235, "uuid": "befbcc60-dc23-4378-9905-3f2d924c5d2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696235, "uuid": "4be2b5f3-b986-4d32-a5a3-0d41b422bf8e", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bc04dfc-cf4d-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1764659268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764659268, "uuid": "7e36eeb1-2073-4503-97a8-b348da5b7d77", "comment": "Malware payload (RemcosRAT)", "value": "11755c66c6e5413b454fd6c7148bb0a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "seguritypostload-duckdns-org", "colour": "#0A0D5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764659268, "uuid": "2463a9cf-1b17-4511-b7f7-39f3bd99814c", "comment": "Malware payload (RemcosRAT)", "value": "124928ecf66ab052a457eaa66af8a81530013177692bc056c19886e8a48a1cf5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "seguritypostload-duckdns-org", "colour": "#0A0D5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764659268, "uuid": "34df87c1-da91-4db0-b478-86de2c530321", "comment": "Malware payload (RemcosRAT)", "value": "71dd07a03e17fca91d97f0be2809bab1a90b8327", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "seguritypostload-duckdns-org", "colour": "#0A0D5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764659268, "uuid": "747b0e65-479a-4168-91fd-fde05e046caa", "comment": "Malware payload (RemcosRAT)", "value": "471e813b33801a7a84fba9a32bcec84037a5db4098b4e66294dd70c1e97875c8269574a3ac2a95e562411d44a4698dd8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "seguritypostload-duckdns-org", "colour": "#0A0D5D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764659268, "uuid": "ea6cf6fb-6458-4579-9cd3-c24fe8bbcc17", "value": "T1A9B49E01B6D2C1B2D57654300D2AE775DEBDBD202832997BB3DA0D57F970180A73ABB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764659268, "uuid": "045ca6dc-c996-4b4c-bb23-a6f7570d0de3", "value": "78a3bdf3c5b9bd3972e77fa90dce8f2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764659268, "uuid": "6b33fd91-137b-4201-9795-92099c119d1b", "value": "12288:mN9WLGVGUYcvqvvCNQzvCZQBm+sPZu4SwN:mN9sGV5YYqzvCZQBmtZjSK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764659268, "uuid": "2a85d18b-50fd-4da2-9cde-9413d83938db", "value": 510464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764659268, "uuid": "4bdcda5b-1951-4830-ac98-be05a1206ac8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764659268, "uuid": "cde35f81-2559-4fb8-adcc-e3e8d7795e65", "value": "124928ecf66ab052a457eaa66af8a81530013177692bc056c19886e8a48a1cf5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fa197e3-cf25-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764642067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764642067, "uuid": "b95be6ce-600a-4884-83da-0072d6972799", "comment": "Malware payload (Gafgyt)", "value": "4ba6eb0faa7628f3dec61a708b93acc1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764642067, "uuid": "567218ee-2892-4af1-aa5f-421c8877e432", "comment": "Malware payload (Gafgyt)", "value": "13628c5214c89740c88e42b2821a924978a270d7553d3efe1bc3dd10f7a2fa31", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764642067, "uuid": "f73d5f0e-55fa-4e94-9081-8bf27fdd82e0", "comment": "Malware payload (Gafgyt)", "value": "520f13342d7360a5ff6195ceca3f9281cb6a04c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764642067, "uuid": "87d806e9-ff20-4f69-958e-c68fb9b2816c", "comment": "Malware payload (Gafgyt)", "value": "5bdc3e7a2893df492ca4a2be59c03fc61862c492d0c33a0de96848dda0ecc558e56978e99e4f0c89bc1ddbd304dbdf89", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764642067, "uuid": "aed12f3c-8ac5-4f7e-ac46-2c3e618e3e88", "value": "T1C273F3B967715E7BEC1ECE7304991816158C864983ED3FAFB6A4C118E38B94F44E7E08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764642067, "uuid": "419a83a6-26a5-4709-a217-067a6f3c91a8", "value": "384:nUZGbdejaahl7eT2ji8e7iHoUuz3otDLE8e7iHoUuz3oyFSO0xNZAnJVVd/kEHIB:wUdc7eT2YEirFakJVVvpem6v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764642067, "uuid": "d368d50a-3ff3-4149-877e-49714cd9ec94", "value": 75088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764642067, "uuid": "86e830ea-1822-40da-94ba-3fe234ff7b13", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764642067, "uuid": "a94ca561-9343-4003-b2a8-75f95e93f2bd", "value": "SecuriteInfo.com.Trojan.Generic.36845228.2498.7317", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a322faf8-cf90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764688056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764688056, "uuid": "22206766-46fc-4ced-8a90-1f9dd55493a4", "comment": "Malware payload (Mirai)", "value": "13876eb13d0adae21d5630d1b4b303d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764688056, "uuid": "f7b3de94-3061-4849-b985-8fb02b87ba48", "comment": "Malware payload (Mirai)", "value": "15d22cde6b2b8eb56fed81d314b7bc9ee9e59b1a631db0fdb74a557c0ffe60c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764688056, "uuid": "1c1dab14-1f53-43f8-b5d6-50c1c9d3976e", "comment": "Malware payload (Mirai)", "value": "cc4cb59006b05f3de7a23d0778713e9436cdd342", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764688056, "uuid": "c0da6cb4-25d7-45e5-8c9d-f4de24034d5e", "comment": "Malware payload (Mirai)", "value": "08e110ae1cceac6f3236dcc715d6e0af7e0299624633ed7d8d8b2c1f524d8c8fc68ca10c0377418d661fd587f73db7bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764688056, "uuid": "ab529314-c18d-4fdd-8247-d035230e8f12", "value": "T17583FD2DFD164F7EFA9B413456AE9E166D6423C537D1E042E2BC97602DA120B380AEDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764688056, "uuid": "e3460148-060b-491e-a54a-fbb1f620ddc1", "value": "768:3r6zjM89GwM8NqvENaHLmNaHHU5knjqbXjgjPP6xRmJEav5YeWtkIxil4HQpcMvA:3O7GWDUoku7mXQ+4H0juuct6EqP6GISU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764688056, "uuid": "fe933f51-062a-46ed-8631-574a651bad3f", "value": 84316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764688056, "uuid": "56678bc8-e644-4738-ad65-7fd489b16b17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764688056, "uuid": "b9d66229-b424-4587-8f33-cd10d10c8ef7", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5ef126b-cf2f-11f0-a129-42010a9c0007", "comment": "Malware payload (Arechclient2)", "timestamp": 1764646507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646507, "uuid": "ba1d453d-cbde-48f5-9f9f-1445e3281f1e", "comment": "Malware payload (Arechclient2)", "value": "363a3337d62f4de65249a423ad70686f", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646507, "uuid": "42582803-cc71-4215-ae07-64955d4ef13a", "comment": "Malware payload (Arechclient2)", "value": "15d3b62bf6fdc899129dcb7e3f3530362956be8ef2d43d1201854a59a3d8241d", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646507, "uuid": "2407575a-6b25-4026-b906-dafcc6516a22", "comment": "Malware payload (Arechclient2)", "value": "dcf608ea3e425eddcf2bc3205ef3e846e964eb6b", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646507, "uuid": "bc7c5f37-e1be-4666-9a26-6ac4d5f777e2", "comment": "Malware payload (Arechclient2)", "value": "2f8299a624980fceeb7653e4888ee69e9108030be7da3a613df0e53c026118dfdef796902e69d8c92f2cb855527ddd30", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646507, "uuid": "5972785b-fd90-400e-9d5a-357c912bb190", "value": "T16116AF20761A802BD6C711B29A1CE77B813CAE250B7950CBD3E4FE7D1E615D22B32F56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646507, "uuid": "da696a24-fc8b-4998-acad-7b202ff7043e", "value": "fbc7cf9faa1ae4978ded5d38c7a3b6d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646507, "uuid": "fe52e051-0bdb-435c-b624-f1fdfeba1003", "value": "49152:vuyQz1ISCnS/djRooJTK7sY7vvvUcwAfUOoYaKggtMt+tK+7xzy1AyBS9ogcTCIU:v81ISCnqjn7Y7v3UcwOwDVpuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764646507, "uuid": "e5ea1c31-a1df-40ea-991e-cc1fca950b09", "value": 4127148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764646507, "uuid": "58058c14-8707-4acd-9581-b2e53ba9f7c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646507, "uuid": "d7c863f8-4149-4a8c-87f5-73e71c130867", "value": "363A3337D62F4DE65249A423AD70686F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8e358e8-cfa9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764698938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764698938, "uuid": "17ead82c-8407-4368-9bef-50b488e44d27", "comment": "Malware payload", "value": "89eace30a0678dff56357703cbf6855e", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764698938, "uuid": "2d68c422-e10d-4af7-b46e-cd224f2a28b8", "comment": "Malware payload", "value": "15f48617894a5c46863519eb3df87cf064eceb0694d655357878f8c796a29f88", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764698938, "uuid": "9748095e-57f3-4481-bbd8-32106477159a", "comment": "Malware payload", "value": "0b941fb43fbf15b3a614783e38740c929d8d7f68", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764698938, "uuid": "8f1f5cf3-21c5-4e4d-9dfa-f4a071625d28", "comment": "Malware payload", "value": "8f90639dee973570bfa3390e573901d99ab1692a766f3852e914770eec3fda9b5b56efd6900ca80fe45aa894f50884a9", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764698938, "uuid": "3033d695-df16-4571-b8a9-87703b0f87d9", "value": "T1BA7395480ADF80ECAA27355889DF8C05F7E5C617165CD6F7FA8FA5B42F0242892F46E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764698938, "uuid": "cf0cb860-7029-4f39-994b-fdc48e6b5fdf", "value": "768:ypSrYE1FQJ7wRJEG88ADnEj1y1Z5RhAJfS9XF0Wf0Z/Rr+wurhbRtAknZbBg0Jzb:eq1LBIKZcFDZCvZchTqv2Jp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764698938, "uuid": "5b1e7d92-28f2-4b4b-80e1-6da34a961fc8", "value": 76511, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764698938, "uuid": "ffc78a60-e020-4eab-a47c-20b489b16fd0", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764698938, "uuid": "0b1426c8-4c7f-4020-9903-648453467521", "value": "1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c5b4e2f-cf2f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764646249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646249, "uuid": "0738bdcd-4584-43d7-ab9f-fd48876acffe", "comment": "Malware payload (Mirai)", "value": "4338063d1e6899da5173bc913cff5fdc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646249, "uuid": "caa6657c-cd61-44a7-83d0-b0e45889536b", "comment": "Malware payload (Mirai)", "value": "163bbcef43c6f5c9d00ae1e62b9b0f0438395f6c3917b51212fbc28118ecd24b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646249, "uuid": "79c40270-af00-47df-977f-ad269034ae26", "comment": "Malware payload (Mirai)", "value": "19e898b15227563c0a999956ac84b6bd1be3e6f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646249, "uuid": "e50c932a-6e81-4f19-bb43-9dc20b4201ab", "comment": "Malware payload (Mirai)", "value": "eca381b2dcf6dcd82b20e25d301485aad84fcbf1718c2e4d4273ff40a5fb921dada80a35704df97e3abdcc7323a554a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646249, "uuid": "d8817bd3-ed4e-47ad-acbf-eb8271d977f0", "value": "T173433B03322C0E17D9A21EB0353F06E093BFF95126E1B68A254FDB664639E7615C2F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646249, "uuid": "68d09e6c-2557-428c-a685-6fe5d4a1d1b0", "value": "1536:1t1JILhthQ+1r4atGKmifAKWNGa6d42+8/:1ufh/w4AK+G1P/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764646249, "uuid": "aa463c3e-1284-4f00-8bbf-c3744e9eb5b9", "value": 60040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764646249, "uuid": "34aab005-9acf-4778-9258-dd6b5c55ab43", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646249, "uuid": "48b12bd4-ed57-4a7a-9f22-a3ba7040ce49", "value": "jew.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34c23c7e-cf13-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764634184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764634184, "uuid": "713e88fa-369e-4720-9c69-250dc366b679", "comment": "Malware payload (Mirai)", "value": "2f126f79fa99d2f0f4f309a65f8fcfee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764634184, "uuid": "e4027f87-0d0f-40e9-ab05-8da8ea150d94", "comment": "Malware payload (Mirai)", "value": "1741b929f96938b3b1ac382beed2cd9630ee56ecc5402eda6ae5b56aee8df2be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764634184, "uuid": "02bb8506-1a23-474e-ba68-0076e399f4b7", "comment": "Malware payload (Mirai)", "value": "d8695701bc939982cc517c8e7cb8fc9e98fa867a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764634184, "uuid": "de10051e-c5ef-40a9-a2f6-77ed03a1738e", "comment": "Malware payload (Mirai)", "value": "cf725b9ba765a5e2576db62c583306af2fe50962154ca44565db91c7718018d72b3aa58a186101f5450f45c4368db399", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764634184, "uuid": "7f41a2c9-9996-4c81-bdf9-bfa5f3a876c9", "value": "T1D213E1BC4A0115B9EF748CFC6AD9A36539F163E3D1519C0B7251B91B4FCA074B4822F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764634184, "uuid": "e0c9ef9c-6fb9-40ee-af61-d7e229aa6149", "value": "768:F9neTVE/QPdMn2IJAKF8+Gx07bn3ngyCkEpP0nO91bBDPJFJgGlzDpbuR1Jz:F9n6oQP6nJAKqtun3gyCkEpP0i1lDB/u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764634184, "uuid": "21c8ef9f-e9c1-4999-aa32-9415f5ffee2b", "value": 44688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764634184, "uuid": "d4a4a3e6-c3d1-4b72-9a41-caa63b3f71ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764634184, "uuid": "9d771e67-f1d4-4d01-a6e8-23489b1d1152", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82fd987e-cf3e-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1764652784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764652784, "uuid": "6ae8b1e2-a726-432a-bfec-74ae409df701", "comment": "Malware payload (QuasarRAT)", "value": "f64203d48c19021a048ceeaf4068b2e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764652784, "uuid": "a1f43457-35bf-429f-9ca9-c7e9ee6d44fa", "comment": "Malware payload (QuasarRAT)", "value": "1808e73f2c78354cfa8e9ad01afcec4bf4111afd316a5d262d013c155b0c3982", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764652784, "uuid": "a35df752-f77e-4ddd-823c-507a57a84bf3", "comment": "Malware payload (QuasarRAT)", "value": "b77f8e2d06741e78e29c61fd17dbc070766b733c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764652784, "uuid": "dac25e5e-d213-498c-a31f-04fa34cd0b8d", "comment": "Malware payload (QuasarRAT)", "value": "d1d4ea037f17ba2aa9fb9415b7d3f3d26203c0f862d287085dfbd8c6ae09c05fa9f96580a3395b4741d47bc8d4a7007d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764652784, "uuid": "3c1bed2e-f645-47b8-8912-48772d934675", "value": "T1B1E54A1437F85E23E1BBE273D5B0041267F1EC2AB3A3FB5B6181677A1C53B505841AAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764652784, "uuid": "63cd6405-096d-4cf1-b77f-2316ecc16c8a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764652784, "uuid": "e72b1f8d-077c-4c28-be10-76a86d4efa64", "value": "49152:rvbI22SsaNYfdPBldt698dBcjHkC/1JnvoGdOTHHB72eh2NT:rvk22SsaNYfdPBldt6+dBcjHkCP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764652784, "uuid": "d501fed7-40b8-41f2-b00c-1912579df55e", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764652784, "uuid": "c43eb75d-c06b-42ff-ab73-b6ecb5f96e1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764652784, "uuid": "8e19484f-bc91-4a53-999a-28d8bd8ec9f7", "value": "pppp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dac18d0-cf50-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764660398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764660398, "uuid": "dcc07d5d-f3f2-48b8-b30b-c2c5e1f53a11", "comment": "Malware payload", "value": "ac055b6c011b2e015de44154e2d46adb", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764660398, "uuid": "9f38f346-d428-4262-86b3-9d32031cbe3e", "comment": "Malware payload", "value": "1845fe8545b6708e64250b8807f26d095f1875cc1f6159b24c2d0589feb74f0c", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764660398, "uuid": "809905ee-cc66-4178-9d19-9b8f72ce7898", "comment": "Malware payload", "value": "abeedc8ac31eaee1948d3f56aa6c212cd9dc8c3a", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764660398, "uuid": "0cb10dbb-4930-4ac2-aa43-a74712bda507", "comment": "Malware payload", "value": "8bbdade805553deb77c2f61c4fcdc35186fcaed4915eb276303fc2c8f75e272d5fd1c7718543886622a234a803e6af52", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764660398, "uuid": "38e4e140-f23b-4159-a954-5376f4e38b7a", "value": "T1F2136A42D3ED10D4E6ABE6798335CA67EEB0358663109BEF8354C9415F13BE0DA3834A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764660398, "uuid": "f421d975-74ed-4219-bbf4-e2a9f75c1485", "value": "b4627789883457d50964a248104cb4c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764660398, "uuid": "fbf7c1ca-142e-431d-b026-305ec2eafd3f", "value": "768:sGXTdrvX2ALmslbQliVhm6xPbqCdsuolEJxqtnjd3jYj/9zN:x2VviPXVCqqnjdEZzN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764660398, "uuid": "3ddc5f51-a114-4d9d-bbf9-f418a7d0af8c", "value": 41536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764660398, "uuid": "61df3d79-1af0-4bda-89b2-4e74715982b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764660398, "uuid": "a7bedc4a-0284-49ab-9eeb-f767b3f2987c", "value": "IObitUnlocker.sys", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ec73092-cf4a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764657984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657984, "uuid": "04b8c010-b140-432b-abbe-e6a2e1d1d375", "comment": "Malware payload (Mirai)", "value": "a7acf3929635445c15af4d9cd0102c99", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657984, "uuid": "0fdc6c89-e3f6-4275-a501-109779ffd32b", "comment": "Malware payload (Mirai)", "value": "185b9bfbea7a1d080e30bb5de2ed72eb604650b3769d3b58db26ce1d49d553cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657984, "uuid": "adf4fb7b-3244-4b1e-833f-bbc54a00594c", "comment": "Malware payload (Mirai)", "value": "9516d9c793ce8851048d1ec0248dfc5bccaf08c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657984, "uuid": "06e02d95-7631-4492-b5a5-c2f67472a052", "comment": "Malware payload (Mirai)", "value": "f86f1090e3b5d89ba8d4b3f19c0c9411c4d2fcf37af924f5914712a5bbbec2eeeff6a268989a409500232cbfb0363424", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657984, "uuid": "0d01f35b-fcfd-4a19-b093-a67671c593ad", "value": "T13A144B0B77118FA1C36896700AF3CB6796E625921AF19986E76DDD107B3075C2C3FEA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657984, "uuid": "c61f4704-b396-4448-b984-a255a0a5a854", "value": "3072:fXPzC1kFT1/EUTfWBGpiTIITABX2svhxxpWHNGzLSJfam:/PzWk/EUqopiTIPDvhpWsID", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764657984, "uuid": "8a13e997-82c7-42c3-bc51-51bdbd57a610", "value": 198792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764657984, "uuid": "2ae5765e-5011-48f0-a519-f449b936ee02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657984, "uuid": "05114c2b-5c94-4027-a2ec-a6cf4acca522", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d49fcc3-cf90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764688046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764688046, "uuid": "b1e25032-0234-4200-a707-42b88d43253d", "comment": "Malware payload (Mirai)", "value": "d1def6ee6007d9b30271bb570b134c56", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764688046, "uuid": "27c8dc92-9965-4f6e-a1c8-8f8447ca4f9f", "comment": "Malware payload (Mirai)", "value": "18d87a171b186b477bf3dab186e9e4c66f71dfe8cef9b7bf94f20c55f62ab868", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764688046, "uuid": "69b04ae5-dce2-400c-9e89-0f42bedcde8a", "comment": "Malware payload (Mirai)", "value": "80afda178693edcb5d3f2c24ef2e33990bbc8bd1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764688046, "uuid": "91626c13-beec-45be-a274-a378e5bd17a8", "comment": "Malware payload (Mirai)", "value": "422ebcc11902495e2cffcd4867f4f36ee7323c24baceb5c0ec0e4d483747e4d4856403ac1059a85548682eed89082b46", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764688046, "uuid": "9a9f8d3e-ae4a-483d-b798-f2cbde9ef2a1", "value": "T165738269F8424B33C0D70279B59DAE4A3F2113E5B3CAB1136AB05BB03EE75171D26D89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764688046, "uuid": "9b2b9b69-b0ca-4181-bd76-d5bf658297ff", "value": "1536:KtnuVzi6cp9i1LNFPvCYc73QbrGtlgDi+ciSI0iW/OS0Knv:ngLSLOYMWO/OS0Knv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764688046, "uuid": "c7f1e5dd-c0ba-456f-b81d-2976e6d5a2fe", "value": 79152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764688046, "uuid": "ca2ba6dd-5b82-4d4e-b44f-dfae8a3ba6f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764688046, "uuid": "8674d052-eaef-4986-b95f-c631a567ff95", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "483815ec-cf50-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764660416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764660416, "uuid": "f669432a-a633-401f-b1c1-859c67c1dab4", "comment": "Malware payload", "value": "38c350b4a232c155c7249ee186bfb01f", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764660416, "uuid": "4d52e29d-4b13-4daf-8246-d26063dc24b2", "comment": "Malware payload", "value": "19188a4c5110709fe0277421eab563bf4d738cdd3766a440e76ff00cd653dc88", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764660416, "uuid": "ee337086-908b-42c9-8faf-e5752cefb4b5", "comment": "Malware payload", "value": "b509051a86483054231579f630540c4683c28fc3", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764660416, "uuid": "3db3ea8a-4ee0-4d71-8aad-5c403844e555", "comment": "Malware payload", "value": "920afc443e58016734eafa8ee43d0b4aaf5f5e9c6492ce93c2170d875e1aeb8581baebe2b543a609be815be5f2bc1acd", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764660416, "uuid": "d77b6c78-38c7-4ef7-83db-ec04cbe71fa5", "value": "T1420633A2E426358F45BA570D222C1C9495B9604B12F24DA17E2D9F4BFECCB2C9F61C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764660416, "uuid": "3f50f4eb-047f-40bf-8a9c-a443305e9ad7", "value": "98304:fOCKAY1fK05TmuhacMAercPVAAAAlcFledToi+d5Fe25Kw7NXbO:fHuB5VhafAeA9AAAAlOlAoP5FxKyy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764660416, "uuid": "8eb0b3a2-d8ac-4491-9de6-d930de5ac077", "value": 3740295, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764660416, "uuid": "9a66d7d0-2310-4bf9-909d-c0baee159253", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764660416, "uuid": "9b20c20e-3ffc-451e-8a97-4a5f28928e20", "value": "chisel_windows.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f38579a-cf94-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764689553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689553, "uuid": "76234f78-91fc-438e-8058-6cb2d741ea4a", "comment": "Malware payload (Mirai)", "value": "1d3883910e88389916b22c78e0bb71ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689553, "uuid": "26f05d57-827b-4216-978a-cee53177abb7", "comment": "Malware payload (Mirai)", "value": "19e8fbd1f21fdd936c55b84e5e59fa039db46ba9d5681c0498433c93f65991d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689553, "uuid": "e6ff8e3f-7244-4f5d-baa4-392b26cbdf67", "comment": "Malware payload (Mirai)", "value": "72e8bdc978733210e6ebe7e8acdb6070f7b1681b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689553, "uuid": "02de4867-9eb4-46d4-95dc-fccf61ce09b6", "comment": "Malware payload (Mirai)", "value": "5e518f64b7e6655d5c947fc8ef3c074770609439085751bb00e46de908527c4351f0fa09f9e1bf2c60c3155208ebe766", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689553, "uuid": "36c17ffa-0dbc-47ed-bf99-a661231fb0eb", "value": "T1BF64E70AAB610EFBE86BCE3706ED074129DC651B22A82B357674D918F54F54F0AE3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689553, "uuid": "6adade23-ee2a-4742-a555-89ea127454e2", "value": "6144:NfqjdIgkAMNLjnk4HMxCBB+KurWgl9Jmlm:Nfq56OCrwWgym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764689553, "uuid": "c9f2e3b3-40df-4c57-a8a5-d396295995b3", "value": 320284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764689553, "uuid": "bcc50726-7324-438c-b1c8-239d48b11c19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689553, "uuid": "a889879d-e5f9-4cb7-b02a-125058d63cdc", "value": "ecco.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "248b2c2e-cf94-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764689562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689562, "uuid": "9b632392-91b7-4c4a-bbfe-4a1dd1244405", "comment": "Malware payload (Mirai)", "value": "3641c0b3eca3d1dac403aad937edb130", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689562, "uuid": "c505278b-3166-4033-916a-7b0ac8194619", "comment": "Malware payload (Mirai)", "value": "1a187916b44feb3b71063698da1c95819070cc96c29f43282fe2cef9c81e7c23", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689562, "uuid": "47cdaa87-324a-47af-96cd-ce805ed35ced", "comment": "Malware payload (Mirai)", "value": "aa1df100b37a392bb6050e6449fb1d00ea689c29", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689562, "uuid": "9d23cb3a-db90-4138-9581-0c2d21c456df", "comment": "Malware payload (Mirai)", "value": "be2b1fcf431eb418ac4f0e77f91caa8e83b4038a3274a98ac0b79f1a6ec0dc47d2a4050691853d2eb3cafaa3358b646d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689562, "uuid": "9330f3b1-4141-4027-8f80-b0654666e22d", "value": "T1ABD32985FC92AA2EC2C317B7EA6F228E335067F4E3DA7113C814076576C954B0D67B89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689562, "uuid": "69998901-4612-409e-95d9-f24991d18957", "value": "1536:i4E2rLSzjGBoyF36S5dKmKh0whqQzV0myNF673+ycIQveZWSg8t2UtOXlSv5BL:5E2rLSv2ollNCDF6bKwsctOU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764689562, "uuid": "d8061bc5-fc99-4d78-bbf4-42796915fd2d", "value": 133148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764689562, "uuid": "a6375137-59bf-467b-8548-3b890000cbdf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689562, "uuid": "73fe1c84-952d-4c68-abab-dd1af4013c74", "value": "ecco.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f505dff-cf90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764687996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764687996, "uuid": "f968692e-9621-4f0d-a2fc-8cfb1e36954c", "comment": "Malware payload (Mirai)", "value": "5a7313fb27f555b283277dda12f1cf03", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764687996, "uuid": "d56caf66-2781-4db8-b15a-bd874116353d", "comment": "Malware payload (Mirai)", "value": "1a1bbc359c5726f1ae1bc0348b776765109e9e8054c14ca83f20a2698b2f9d3e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764687996, "uuid": "0cac0c01-4a67-4fa3-9a4c-cfa96a7ccb7f", "comment": "Malware payload (Mirai)", "value": "df8281ef22f7a5306853932314df48981af98f8a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764687996, "uuid": "92eca402-8e7b-4b7c-bae0-fb33744b2414", "comment": "Malware payload (Mirai)", "value": "1bb16a2713a2f191f2852aa45d898fc22e59a71ebbf885f3615d203b0930481fc35ec02ef28c2c31f52e8fe0472bfda0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764687996, "uuid": "3fac566a-7203-4a78-9b87-4b58984fafd8", "value": "T140C2D10E94C1FAC3DB1D0DB6A1DD0B656814228A31CB5B6C37548CC1F52ED8BFA9817A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764687996, "uuid": "dc6e7b95-e1e1-4ea6-82a5-d0f21c1026fe", "value": "384:C1Fhmz6MGL2T0WVU5+kUSmuG8m4BuvdjVYh7i++c3OOtzCsSwZ6w9RWGVCz0NvZ+:vzkLg/U5+kVjuvFVYh+o3Oa2sSUW9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764687996, "uuid": "42ea21d3-6a62-4c5c-a3db-5f1ad4703705", "value": 26104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764687996, "uuid": "9bcf8d24-bf2e-480d-b54f-aceb0d196f5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764687996, "uuid": "07942044-2a42-4e79-933d-77a8595a79f0", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee32c235-cf66-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1764670143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764670143, "uuid": "86072415-74b9-4f21-be46-9639f6fc6159", "comment": "Malware payload (RustyStealer)", "value": "2af55e53f0619d0464df703b261f9f33", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764670143, "uuid": "1ace7e62-a29e-4c0e-b078-f1456efd9fd2", "comment": "Malware payload (RustyStealer)", "value": "1aabe00bc635571ebc9b9c41dcba119a9d49f80c70b9f9e8d26f9fb9743a6304", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764670143, "uuid": "bf10cc39-a798-4c93-98b0-cbc4eecf2316", "comment": "Malware payload (RustyStealer)", "value": "d19ee507f24c8ce649c0946cdc0b663b2742c9ae", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764670143, "uuid": "8862028e-de00-40e5-a2b6-073f52f6a8ff", "comment": "Malware payload (RustyStealer)", "value": "81a0b397afcba8a142462d58f3c42f989c4d1cfbaa2f3f6a4ddb5092941ebe80d0cad31ee8eaf0fd81ccc56cb39c9cbc", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764670143, "uuid": "36e58c0c-42de-42ae-8a8b-d16dbf5b014d", "value": "T13DF42A47FA6685E8D56AC03C8B5AA136F63278D9473066EB23941B2D3F53FD06E2D340", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764670143, "uuid": "7e97eeba-148b-497a-b8b9-7202da32a77c", "value": "814dcbbe8310950c83d3b5258f29f3c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764670143, "uuid": "ef4005df-3311-4cc3-ad3b-88eee2bbc099", "value": "12288:32cV/KnYxigd+RhFTRtysRJo1/Rv3qsk22xIqn8V:mY/wYwgMRtyBV9V+8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764670143, "uuid": "862ebd96-4466-4564-a12a-a1c7faf61990", "value": 754688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764670143, "uuid": "7282214b-002c-4ad4-a776-4dbc3d2dddb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764670143, "uuid": "9cf10301-1dd2-46af-9f71-d07588961aba", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a5d3354-cf94-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764689518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689518, "uuid": "cbf55204-17ef-43c1-a64e-e92926d8b7ae", "comment": "Malware payload (Mirai)", "value": "124a2542c250e9ad72f561ccb856113b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689518, "uuid": "87cadc83-f5a6-4833-8079-a4d19430f6ac", "comment": "Malware payload (Mirai)", "value": "1ad836d660c035a9c7ac245e9f4ca7e97df95cbac4cb3c00b6a6333a2b0f264a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689518, "uuid": "282135cf-07b7-413d-9c73-428ff90cd09e", "comment": "Malware payload (Mirai)", "value": "600a5fa7cf3ec27343bd1d4a7b381f69550be03c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689518, "uuid": "8e016b77-dda0-4de2-b022-5fe0a6c76ca9", "comment": "Malware payload (Mirai)", "value": "9022e12bac0956b0bc8ce09f431d79df3bdaef30edff32956b346c812780147e70b79a0f1bdcc7215db6c88a09ed32ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689518, "uuid": "18876ded-4ee2-429b-bef3-c028fedf8fd7", "value": "T17873022B97AA6115C06135B41C0AF043E665CB231E7EFAC94B827907A941E38FB35EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689518, "uuid": "bfae9498-964a-481e-927b-b91000e2691b", "value": "1536:skmWaNqHYtt8vhFEZYVjXyVVKZ06Djafca7Lgt7sjCl6bdH5fD6do9nouy8Hyw:DmWBeWYOVjyVUy6DG9RX5fD6daoutf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764689518, "uuid": "9fdd9f16-092a-4de3-a405-093794bba646", "value": 77028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764689518, "uuid": "f6341d01-f7d4-4bd1-b54b-8f14b2d2c4ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689518, "uuid": "0a3cbee4-5d96-49b0-98e6-fc07790c7a13", "value": "ecco.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42618f15-cf47-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764656541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764656541, "uuid": "4c15dcc1-7fe5-45be-863a-7d83a086f9da", "comment": "Malware payload (Mirai)", "value": "82016854493d2854e03be052765a823f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764656541, "uuid": "6d74d9fc-0d05-450a-ba1d-827fc21a7932", "comment": "Malware payload (Mirai)", "value": "1adc4acc0f89a4328048c171d0ed26368c95237fcd583cfe0e1264c7f0ba947e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764656541, "uuid": "ebc30fd7-a388-4438-b3c9-8e38cb3c1fc2", "comment": "Malware payload (Mirai)", "value": "69efc7ff83d5432292c8bc2e7e52d2f97e406a48", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764656541, "uuid": "d7ce78d3-6e7f-4f14-84d1-2a83629ef9cd", "comment": "Malware payload (Mirai)", "value": "e98f69ffe4b95cf9e60d122266c271adaf18204020689af75519eddc3b5402018c60265ee54ce642123d7feef85eb16e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764656541, "uuid": "085e6f96-e471-42fd-978c-611c9be46c9b", "value": "T11043185178D19A16C6E423BBFA6E40CD372563E8E1DF32178D212F1177CA82F0DA7A91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764656541, "uuid": "fa8511d0-c9e7-40d5-be22-e624b5660092", "value": "1536:saEJMzL7BC+nfbXq/5XqbFJ9WhKvriEALd2:saDD2/kJQhYbALd2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764656541, "uuid": "a408c89d-ad4c-4e28-9949-5e7e19521b02", "value": 59988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764656541, "uuid": "9426a26f-b0c5-427f-8cc5-c634556f8f22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764656541, "uuid": "b8394c95-abd1-43ed-900a-c7bba5f3b002", "value": "jew.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1245aff5-cf68-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764670633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764670633, "uuid": "b53fb24a-e91f-4f25-bfaf-86eaa19a576e", "comment": "Malware payload", "value": "6f4b2f4b1622ba95a49ff66a555eee27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764670633, "uuid": "ebaa4b68-6a5b-4ebd-86e3-e44c4f0bc2e1", "comment": "Malware payload", "value": "1b4f9d724e345ca57ec443deca90e167d2ce1117d56ecf01831faa9104517b9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764670633, "uuid": "a3f4f140-c0f3-4127-8ae4-917941c35b7c", "comment": "Malware payload", "value": "2a90f1ca290ccf5b56e670ec41b6e61702be358a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764670633, "uuid": "e4009e5e-2cc7-434b-9e36-3c5d084bfb08", "comment": "Malware payload", "value": "adde76d1614b8b93bd03f7d4aefafce1624409ffb08379e07a89d999051e62b2705a9cc8e16d43d4eb8a1ed3c9e4ae81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764670633, "uuid": "20887d97-f090-47af-900b-efbacc0bae59", "value": "T12E256B579A9711B8C969F0FDD38B912E5267EBCF5300AB87C0DA198330666B3F1E1235", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764670633, "uuid": "b3fa1808-8afb-4e8e-a657-de19d87dd83a", "value": "02e174419d64d9ccbe3009b1d1ee7faf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764670633, "uuid": "e7016ed1-19f9-41b1-b348-3effe5c089f0", "value": "12288:F3QprU++f/So2tXFttwi4t1GWGsgRCksOLzJk6iPvhpHdHvkI90bPsF6Ox9NeV/:F3QdIf6lX1wiw1CsvO3LiPXhvcPE1eV/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764670633, "uuid": "15ce4047-75f9-426d-a21a-ecb011ca9b43", "value": 1036128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764670633, "uuid": "bd725b9e-ca6f-4951-ab9d-f4c191b5e424", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764670633, "uuid": "7d96f7d9-a3e7-40b2-bf6f-8d6504649926", "value": "Upwork.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4383994-cf2a-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1764644384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764644384, "uuid": "22ba013c-d171-45b7-bc47-0d0f580a5690", "comment": "Malware payload (AgentTesla)", "value": "0cfd5ba006c61407e841fa34d188a857", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764644384, "uuid": "1d53f89b-e028-4ed5-bc1d-b49c466f2c16", "comment": "Malware payload (AgentTesla)", "value": "1e3ade4c0b3400119b39ceef30eadab6a91ae0332ea868a9d2692047e7dd9566", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764644384, "uuid": "e1aaed21-bfa1-4a71-8816-7c1613aad58c", "comment": "Malware payload (AgentTesla)", "value": "5e13bf7f8f5b1fdc223c23e835bf9f667ba17d25", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764644384, "uuid": "8c3dc387-ae2b-470f-abce-556e6a6438e5", "comment": "Malware payload (AgentTesla)", "value": "9a717d101fc6f849377a4bb8e2e26368989279c47eeee51a0b6db42dbde6377064636acb3b79f1ecf6ff9df65acf3a34", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764644384, "uuid": "3119dbbb-bb81-4404-aa69-a08b900a6e64", "value": "T1A2F380B433C0782523871B777B2FB4D5EA1B0EDE3454464BC218BD9079A9B1BE5E2932", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764644384, "uuid": "b7ad8919-f4d7-4d91-b69a-afed558d8e58", "value": "1536:mt59Ej/ot1An6zqnvVmkrZEMNGYrfG2aldLgicnRDL9/ch7c/M/6G:mRgs1AtnvVdFEaLiAHG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764644384, "uuid": "a523081a-c036-4cbb-ac06-1d0cfd327d61", "value": 162777, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764644384, "uuid": "0a81165e-a9a2-4660-9c86-0e40a188e118", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764644384, "uuid": "7b681d4e-dc53-40b2-95c9-f1c1f381eb72", "value": "RFQ - UID01553.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e1c0648-cf7d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764679780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764679780, "uuid": "a313c993-2880-41d6-b64f-08070f47a000", "comment": "Malware payload (Mirai)", "value": "ee2398c384d84023e8dafce0a55e705b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764679780, "uuid": "637fd35c-0187-4580-885a-14f631a6a077", "comment": "Malware payload (Mirai)", "value": "1eadf395cc63b19e46a0ae785c36ad60e2ebe61dd1eeb09036e132fb5455ba5f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764679780, "uuid": "6a61aca8-6b8a-4420-a433-310309b1cd14", "comment": "Malware payload (Mirai)", "value": "74e0b935cee095d2e68303562e45a11abdf639d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764679780, "uuid": "54b2b547-02a1-41e3-a5fa-b65b2642e93d", "comment": "Malware payload (Mirai)", "value": "71cc1cdb987cbb66994ea286d91c55807d5398dcab443243a1de5df12103d4b84794730ab8e25381cc132dc1701ebc1f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764679780, "uuid": "f7c42a19-a7b7-4664-824b-7cabef7a8c22", "value": "T128231A0AF603D6B7CC570BF642ABA6AE4630F9285E264D5BF31C7CB4EB139843116325", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764679780, "uuid": "af1dbd1f-326e-49a2-a668-56b3a411357f", "value": "768:rkxwwa6/EGtCn5cuUTNrGY0qhHeCbvAz/cRue3:r9ZGtCiuUkY0sHZLAzJe3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764679780, "uuid": "c3dc4369-83c0-4b64-81cb-dcedbb2d48bd", "value": 49457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764679780, "uuid": "f778e775-98cb-4b6f-9ae3-8c31b44ad7b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764679780, "uuid": "e025e61c-1edb-4195-a277-edb468bfa546", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f315d6cf-cfa8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764698498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764698498, "uuid": "184def2f-8bed-4be6-8a73-a8d32db0edb5", "comment": "Malware payload", "value": "fd084a52d0b57f5960c1a89cd7d7e698", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764698498, "uuid": "0fe922a5-260a-4c6f-be67-c0ecad816644", "comment": "Malware payload", "value": "1eb42d3c9788ea9f11d9100b89f3748c40d7e054f76fcd5a22e15cdf5d1c2ab3", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764698498, "uuid": "e25c7cc3-51c2-426a-9d7d-39aa970ea0ff", "comment": "Malware payload", "value": "635a4e3672760df9851a616f755a60827c0baff1", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764698498, "uuid": "0c3b3dd6-aa7e-4dd1-8c93-941115b483bc", "comment": "Malware payload", "value": "3608783501e0651852cc9a8e2f9ab1c46bf56ae5c61f3b7685bfffc47ebd208916f44d1edc4ed40a920890c92482d977", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764698498, "uuid": "756c8d61-5f45-436d-bd53-5becaa749cb1", "value": "T1C38423D22B294FE1D1D5DEFB14D7A607AEE32C82958D942223DF994B52D1BC1833E903", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764698498, "uuid": "363f70f1-dd3f-496c-af85-ab6b6b9874eb", "value": "60559adcf3698c3eb3c69577ebf28413", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764698498, "uuid": "2641ab8a-0f5c-478d-9b88-39b9d9e359cd", "value": "6144:H4v+WDMdMkKB6IV3gHYZsxj4Pg8gfO1Wpou7AGWVal3vvAjWgwW0pIqM:HM+WQdMyFHYZsx8Pg3B33g2PpIq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764698498, "uuid": "5055aec0-eed0-448e-b927-e09e3c3cabb6", "value": 386048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764698498, "uuid": "c29ad785-6ae0-4342-8efe-86dddb002c46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764698498, "uuid": "053933c2-6227-4703-9548-986ab43c324a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82a04ca3-cf99-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764691867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764691867, "uuid": "850ae49a-7b6a-463c-bb3a-a4cd0133ad21", "comment": "Malware payload (Mirai)", "value": "aeeecb67f57b96bdee4fd939ff4740e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764691867, "uuid": "d25d7752-16b6-4400-90aa-e17f8809802b", "comment": "Malware payload (Mirai)", "value": "1eed31ee2fb285854113bb86bcea886aa8d1a2b11eb012ef9808336569026cc9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764691867, "uuid": "678b12ca-1a9b-43ad-acb9-8d4ee4d8a2ab", "comment": "Malware payload (Mirai)", "value": "1728d21f399de84291ac813f5dccedfe98864b0f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764691867, "uuid": "90e2e51f-2b86-4711-9f5c-082b40e792c1", "comment": "Malware payload (Mirai)", "value": "a1b4f2d9bae70fa30ccddfe109e113dbf0dc9df1ca5089173b29c43e9dbddbc7803510e343af0ea62bcb91099fbd907e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764691867, "uuid": "7566407d-f2df-4673-ad5a-bcf5aad484bb", "value": "T1EEB31208C98BDE66C74158F1C2CADE8396BCA7B0509794BD6C4E46309E82508FEE1AF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764691867, "uuid": "c5d3eb96-f2e4-4562-9e5f-ed76e8d7588a", "value": "3072:z0YMBJhtR6XZYmYXim5JI+Nsu15/QBcYQDN7cTLJVW95WbAbtLD:z0YMDhiXiS8sBbQDGTLJVW95WsX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764691867, "uuid": "cdc6aa13-9258-4074-a3e8-da4d7d457b09", "value": 110984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764691867, "uuid": "f60cdfb5-b970-40dd-9ff8-5f13eed5c980", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764691867, "uuid": "2527bee2-ee7f-49d1-ae14-9bff8843d290", "value": "ecco.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84fecb8e-cf5b-11f0-a129-42010a9c0007", "comment": "Malware payload (a310Logger)", "timestamp": 1764665242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665242, "uuid": "ec170112-df0a-4265-b20d-9a796707e433", "comment": "Malware payload (a310Logger)", "value": "081c34be3592ff132276def9bd6968dc", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665242, "uuid": "7551c18b-dfe9-4fc3-886f-4249ec946184", "comment": "Malware payload (a310Logger)", "value": "1f9e7ccdbb6aecb1c353461b5bc162a24c3df9acb5493d76aa0e8f1c6ec1190d", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665242, "uuid": "55b54ce7-ec33-4be3-951e-dc2a0d7ec0b9", "comment": "Malware payload (a310Logger)", "value": "4bb66185163714302c3a01c08d1d3cee6332abd1", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665242, "uuid": "3b1641f1-1149-4f26-b805-8a63cbc2b46f", "comment": "Malware payload (a310Logger)", "value": "ed35535276604980b57a805ba848b499b8aefed35858d3c6e7394b9653e25e138eea80d2832ab22fad939b509f4a8bb1", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665242, "uuid": "c70ec070-42a1-4286-a2a8-912410d9cc7d", "value": "T13C0512B15385CE22CCE45BB20971E37817795D4DA673E3134FCE8CEB796AB266804392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665242, "uuid": "ead05589-1679-4299-a139-22bbcd843531", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665242, "uuid": "4de00dc0-7a3e-45b1-a9e7-134dc7424ef6", "value": "24576:FEhojMW1fYgUcwSmnSQVoq0TKJ9fylScdk1cjA:FEhoTYgUPhoq+MfylSwUI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764665242, "uuid": "d9c39313-c9ed-4b85-900e-2a6cff601713", "value": 827392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764665242, "uuid": "acda9183-4291-4855-a43f-48d33ad12e62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665242, "uuid": "41d7e4ec-41ac-4c7e-bd5c-3a52f7361c05", "value": "FYSY-ZE46102019403871_MMSY5030030.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0e5d498-cf51-11f0-a129-42010a9c0007", "comment": "Malware payload (PrivateLoader)", "timestamp": 1764661075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764661075, "uuid": "8ee03af7-46ec-43cd-907d-36beca141b5a", "comment": "Malware payload (PrivateLoader)", "value": "e4ff0d98a865d6bc1a4fa3c574448d41", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "flystudio", "colour": "#D3D460", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764661075, "uuid": "f1af56dd-35dd-4438-968b-4053cab53d5b", "comment": "Malware payload (PrivateLoader)", "value": "1fbeb5c772b2e1c7ee65ac50c323f23ee912abd323f5883a148a5f1d28f282b5", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "flystudio", "colour": "#D3D460", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764661075, "uuid": "00fa1eb6-ec56-4e23-8b36-5811d48cf35a", "comment": "Malware payload (PrivateLoader)", "value": "85cd17904f1112b6bde09a99f0db02be5715c80c", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "flystudio", "colour": "#D3D460", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764661075, "uuid": "317b3ac6-5c78-4987-8f1a-b3f3f9bc261f", "comment": "Malware payload (PrivateLoader)", "value": "53054a76f20856c6494884475be356c9bacdff9939fc747471a914f718924f625aaf8191705c16505c163842eeae9626", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "flystudio", "colour": "#D3D460", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764661075, "uuid": "a2274acb-23a0-4eec-89ea-dc35d734f8cc", "value": "T12428AF02A410617EE14B11B1291DFB3DDE700B4E4A294EDBDF9C6DE9AFF41A0361B687", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764661075, "uuid": "b67fa0e2-96f8-43b6-af55-e5110ba3c867", "value": "9a748e87e90585df79fa2d8b7561c311", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764661075, "uuid": "8acdae0f-8382-4b40-9801-0d725718484b", "value": "1572864:D7qIpNWrt4z7ORAoALHU3XhkzOpaire4vixOu6nKBaFWax08mc4PBHBQclPJaVCi:TlLHU3XhkzOpaire4vVWLLqlT6cUZ/xI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764661075, "uuid": "e1d5c0a2-5ab7-41b8-9a1f-73135223828e", "value": 99415744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764661075, "uuid": "6e784cc7-edad-4c46-b04b-69e1117fadc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764661075, "uuid": "2eead46b-fabd-47d4-9640-a71ca7ee7e21", "value": "\u91c7\u8d2d\u5b9a\u4ef7\u67e5\u8be2\u5de5\u5177\u7bb1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab97a4ef-cf58-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764664019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764664019, "uuid": "e27b57b7-e63b-47ce-bd78-5f6f4a2b6861", "comment": "Malware payload (Gafgyt)", "value": "43a96a0d6331f1825e793a33d195bdaf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764664019, "uuid": "c399d747-3abd-4819-8cb7-72a5225f29ae", "comment": "Malware payload (Gafgyt)", "value": "2038ccb0da0344fb14a4ce0f14d896525cd9cb575772db54b59b154c6d2ae639", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764664019, "uuid": "770abcc5-23f8-4893-b155-b3458f6e0aad", "comment": "Malware payload (Gafgyt)", "value": "13b69897bce7446fb280f3c254c9f7f8fa32a93e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764664019, "uuid": "9d0d0ab5-0d43-43fa-9bad-2db1b1d6f9c0", "comment": "Malware payload (Gafgyt)", "value": "77712d9784dbd7368d6d581c4a37ad5fb767dd2bcb2a8242abfb770ec9cfb36c11ec0cb0fa8b7f03f758414583ad9213", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764664019, "uuid": "7ab8101a-f292-44e0-bdd2-e37a66b5e649", "value": "T15F43199BBB2C0B97C4DB56F02CF737F08B69B95112950185A60EFEC40763BB06816F66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764664019, "uuid": "7b24026c-bbb5-41ca-ba78-ff46410730ac", "value": "768:0HJmQR8yJ5DyWJz8RX6M2dudnMYz1LmWp/gznIXVwFVjAhhdZBauVw:mJmQRw+8x6DdudnMOEWJwnIlbPVw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764664019, "uuid": "147c3cbd-0256-42c2-b4d9-8fcccab6686d", "value": 57398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764664019, "uuid": "c5950c17-2130-4e13-9b46-830464479efe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764664019, "uuid": "061591a9-fe7f-47b4-9aa9-9d44f2fbd500", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b566248e-cfa3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764696247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696247, "uuid": "8833f1db-c0b0-4ba5-a490-b39a2bd3b919", "comment": "Malware payload (Mirai)", "value": "24dff65ecc024d52ae579ce8347610c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696247, "uuid": "a0ba0472-bda4-4447-8154-4883af06c3c7", "comment": "Malware payload (Mirai)", "value": "2048ae9e29fdee5701aed81102fef12e1db78e8fa9f427f4cb84844edc10cef8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696247, "uuid": "182f09e6-f45c-4648-bb87-d688c20155c2", "comment": "Malware payload (Mirai)", "value": "cd5cc3bcd2d9724142fb689471473246a00ced7c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696247, "uuid": "e2851df7-dc57-45fa-bdcc-ab6d4955e284", "comment": "Malware payload (Mirai)", "value": "104eca1bba621a30544ea7bea0bd9d18b983a39ebf62d09a749de6d153f7e065a1a4bda44420fed05c2e4fd326b1119d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696247, "uuid": "55e76073-3ad3-457a-bbe4-d05b97cbb67a", "value": "T15404C81AAF610FBBDC6FDE3706E9070639CCA50722A43B363674D528F54A54B49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696247, "uuid": "75605a68-527e-4dc2-9e0c-3e0160c23aa9", "value": "3072:gdbQ+ylOFS7Sm/40uQ0utYMkOk9A8HLN:gdbQBOmSK40l+bOUvH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764696247, "uuid": "e64363d0-a435-4b12-932f-d0b8f0fdf39b", "value": 190024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764696247, "uuid": "74b815af-3ffb-4134-9ead-2d6a5e20db12", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696247, "uuid": "0cb25c91-6ee3-4238-8382-d393d972e996", "value": "nshmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0170d5e6-cf3d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764652137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764652137, "uuid": "4cb6ba48-1c1e-40fd-bdd5-51bcc5e95a7c", "comment": "Malware payload (Mirai)", "value": "89116f56af5d4eab7917440f3b025fd7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764652137, "uuid": "d90c09af-ff39-4d3a-94fa-f827fe501fc9", "comment": "Malware payload (Mirai)", "value": "2128a1f811a4afe9324e53259295182adc3872f3c01ac54367264e2e851f8b60", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764652137, "uuid": "be6a6ea1-996e-42c8-95a6-54adee74eb19", "comment": "Malware payload (Mirai)", "value": "f579fc825cc9f888338baa1960c3aac67b37bbcb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764652137, "uuid": "2830a631-da4d-4f25-ac8f-9b5497f9e052", "comment": "Malware payload (Mirai)", "value": "f3fa1b724a551a7fc66e90081af306f4463ca4c25da68cbe3a8fecff2f1f205302c1333cb156291cfdab574a7cf489d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764652137, "uuid": "7ee983e7-61a3-4050-8d43-6204e3bf4ea5", "value": "T170A36D22B8341927C8E8A47B13F34327F1F2578E24A88B5E7D720EDEBF155902A57674", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764652137, "uuid": "dc9c6e8a-41b0-4fe6-8f97-37dabd24b030", "value": "1536:eqy2/wkLDFY4Ki11IxRfZM5iP6Nju+1tfX+l+58hnOEHK+tSqIC:l34F5Bypj7Julm8hORBC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764652137, "uuid": "cc2afd73-1b92-4a86-b4e9-d6fe6e14fa62", "value": 102248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764652137, "uuid": "fc0f2738-94eb-43eb-a79f-a6c637f6f26d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764652137, "uuid": "c45d7ccb-9551-41e8-9f9a-4a676d0e3271", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c4998e2-cf87-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1764684126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764684126, "uuid": "ce9485ae-c375-4ff0-9fe0-6f233cc507b8", "comment": "Malware payload (RustyStealer)", "value": "e2032cda9a5da097ddb4c84161e160e7", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764684126, "uuid": "3de26e1e-ee2a-4df6-b6d3-2e16b369eca4", "comment": "Malware payload (RustyStealer)", "value": "2184ef764cc36e8cc8eeb6b9eba1556853817c83fafe32f9ced5d20458d1110d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764684126, "uuid": "ad4addd1-0a32-4354-8fd8-3454f1be366c", "comment": "Malware payload (RustyStealer)", "value": "ee74eef85afd2c8b3f2d725a12436b899a50eaba", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764684126, "uuid": "7c857b96-3ddc-4ca2-bb59-f60aac7c0e8c", "comment": "Malware payload (RustyStealer)", "value": "2b99cca59b56a6318fb900a7e2edc804424de7c4f951b22afe9e212775b8f282be0e3f09eff17d7aaf308ccb3c301911", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764684126, "uuid": "f00dd662-53b7-4c8b-b934-47e5cc177a0e", "value": "T18E74AF1AF95668FCE15AC474C34586637A26B4CD0B2279FF12D842387E69BF11F38B44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764684126, "uuid": "727d573c-df34-4e0b-abc4-d0179001c634", "value": "ea18bc4df589419f6162a97e4ae3a39d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764684126, "uuid": "bfe7e132-110c-48ac-acf8-82a9880740c9", "value": "6144:h3pj/AQZogERoF9bVUuQWFZBP/kDmom39oxI:7dZhWs3kDrCo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764684126, "uuid": "fcac862e-95ff-44f2-9625-9f1ae1346670", "value": 337408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764684126, "uuid": "bc62cf8b-e34a-4a00-a965-3d606edc82bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764684126, "uuid": "02dcc263-3c92-4b19-ab34-2348ea91facf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edffe0e0-cf39-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764650816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764650816, "uuid": "0a02eed4-d414-43d4-9df1-86289b3e6a02", "comment": "Malware payload (Mirai)", "value": "7ec2dac6667c1186a71bb9c317201e42", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764650816, "uuid": "64247f0f-ca60-4012-ba1d-3e63909ec781", "comment": "Malware payload (Mirai)", "value": "2187a68d3ad1b9b853e22d6892347d26e17d96d871617ce9b1d4e5a179360001", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764650816, "uuid": "8f071b3a-e38c-4ef0-bf95-72da6b9808b0", "comment": "Malware payload (Mirai)", "value": "6591568d646a4a177fb1e10d2cc0aa310fc4d7bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764650816, "uuid": "5699df1e-245c-463c-a605-31e289ea9518", "comment": "Malware payload (Mirai)", "value": "2af1a61eb0c70c63294c90b3c49a943d00df557bca92727f4d85b9d4f2484b1d79f34957ef788c21137399549b0c2f3a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764650816, "uuid": "ff6af981-0407-45dc-b286-105a519dd44e", "value": "T11FF3282F358591F0FA411B746BCBD3A76C690BBF1099A0DF6B416329F6E0A77A02C447", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764650816, "uuid": "8d94f901-8988-4805-9ebd-27048e9754f6", "value": "3072:vTkGHs0vzz9efe10scE+JdRAF3ksR3X6WLOhNU2SoNiPLTU055mhUXw:vQ7a3V4alkS6/iEiXU05cyA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764650816, "uuid": "c423b598-e0f4-4380-a427-36954ee5f889", "value": 172660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764650816, "uuid": "4cbe9f24-c209-4821-9757-41308ebdb3b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764650816, "uuid": "70dde97b-89f5-44b8-b077-fa6820ff912b", "value": "xnxnxnxnxnxnxnxnor1kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dee49a2-cf76-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764676639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764676639, "uuid": "11684433-3e62-44fc-bc65-b644b8611adc", "comment": "Malware payload (Mirai)", "value": "3b646ef431dc2ac76131350f5df82de9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764676639, "uuid": "5a097b0d-9003-4b1b-a986-755e049c3aa0", "comment": "Malware payload (Mirai)", "value": "220f8abff679ff9fa941cfa8db83f003225e033ab0c21e9e5bd2a806100b0e75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764676639, "uuid": "7fbc23b7-bdc2-465c-b21c-3e6396f9a22b", "comment": "Malware payload (Mirai)", "value": "f0cb41f8c266f854e3cc57a5d4e6de40c92dd3ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764676639, "uuid": "bbd55e0d-9c3f-4332-a3c7-6948e49e6192", "comment": "Malware payload (Mirai)", "value": "0cfff0c4c35d6d32329899e253628ab269168c07231a7dd157ace10f0ea8c9b0d9aa0b56d73c26dd5b44dc0a4113aa87", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764676639, "uuid": "3d8dcbaa-2ab8-46e7-bc7b-712da026fb24", "value": "T11B6302D4D44CB693C47D0EFA94AF0B199E24B36C7AC58A9CD3BD4304C68730A74910BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764676639, "uuid": "83971fd3-76c4-4c6c-91df-4484e014f42d", "value": "1536:oYTnjYsHsIeNgRBJ/FQ+2DK6JRqxb19Y75pmcpF5q7:bjYkMgyJkC7DmcY7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764676639, "uuid": "ed931cd4-5569-48d5-a708-1eeb7ae1476c", "value": 69164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764676639, "uuid": "9257d893-9924-47c4-8203-068a06a32857", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764676639, "uuid": "8ae0ead1-1ac5-49b8-a6d1-d889a760ca11", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "028bcee1-cf44-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764655145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764655145, "uuid": "530e3d25-a11a-4df8-b9d6-74398e106be7", "comment": "Malware payload (Mirai)", "value": "e475ea1d6869b1bd4b67aad0f577be47", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764655145, "uuid": "4d6ce29c-b781-46a6-8314-b9a1cdd20fae", "comment": "Malware payload (Mirai)", "value": "2248c96ba4f163ba4b49df7d27bec39a6148b6dbfe93f1ce11c35b2c91797c6d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764655145, "uuid": "c82e8358-798e-41ac-8ade-971c56415202", "comment": "Malware payload (Mirai)", "value": "46494d68daa4aa38bb9d76652c51dcffa7181526", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764655145, "uuid": "69414c6a-6865-4642-b22e-1a5cb97ac479", "comment": "Malware payload (Mirai)", "value": "f353228f064b38c56a6887136438e1f1d7beca39bc40dc08a9176bbaf75f3b3de5dd4c2778750c18a80e2e09cdfa7f2a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764655145, "uuid": "734c47e5-5f6a-4394-98d5-bcef2dda1e9e", "value": "T106C012A4022E3598479C486C7663C615A060666818750B21484575B6C0D454EF0EAE06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764655145, "uuid": "79a28a24-7065-4d83-bafe-3948b4cc8fbf", "value": "3:TKH4vewkP4ITuVCvsiNXqUUXrn3Za3BFSLMf6StqUUXrn3pz3BFSLMvEJ46v:hlIWxQqxnQyMfVtqxn5DiMvgr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764655145, "uuid": "b3ea14e4-0c11-4c88-84de-64ab9ed41961", "value": 177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764655145, "uuid": "c7020a66-e7a3-448b-af9d-c6439d737ba7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764655145, "uuid": "9ac672e4-c52b-4481-a3b4-0d40d4d6b827", "value": "t", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "943efa58-cf2f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764646370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646370, "uuid": "c6ef5d9d-8ec6-46ed-a8eb-e5e0c1da7824", "comment": "Malware payload (Mirai)", "value": "b9fc3cd0f3cdb75555d893aafac0446a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646370, "uuid": "77e7ed61-150c-49fb-b94f-0f7bf3ec34e5", "comment": "Malware payload (Mirai)", "value": "23e0ebce22aca24601b5cba8f7f10a68503fcc78ba5d6ff1ed0eb6c29ab4d2b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646370, "uuid": "0e878cb0-ade5-4714-a5f4-9862006e92a0", "comment": "Malware payload (Mirai)", "value": "09ee5313356e7609db08e793f28706d128b4da38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646370, "uuid": "0092656e-50bf-499d-886f-2ae1da9f6cea", "comment": "Malware payload (Mirai)", "value": "58b247e46e35b1e0c5219c9b39c4ff33a548d7be3416c8cbeb10682550be032819ef408a6f6f9bf2307ec470415d3eb1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646370, "uuid": "3ffe569f-2850-4b33-89d8-0ec9a8a67ff7", "value": "T1AB333B42B22C4E4BF9E65EB0353F1FE083BFE99424F0B584691EEB458635E761046F89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646370, "uuid": "5747840f-4b38-4e65-96ec-577420914078", "value": "768:jF6F4GRot7K1GAgmya9RtqhoMajwL3yragOJwk6U8jbhmP1mAnUb4:MFXU7K1GAgJC4ZkMyBOStmPcAUc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764646370, "uuid": "04942ee7-e806-4cf4-8024-3c3757a20329", "value": 50580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764646370, "uuid": "ab8c9668-bead-4883-9224-d1e2b6bb7dd0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646370, "uuid": "1d886469-2f3d-4623-b08a-9132e5962d0e", "value": "3atoNational.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0df7561-cfc3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764709957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764709957, "uuid": "756177a0-c271-4572-8a61-ff9c92db1011", "comment": "Malware payload", "value": "9995e80462f476653190e413412825ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764709957, "uuid": "8a61cd3e-f63f-44c2-9094-23b2f0da32af", "comment": "Malware payload", "value": "244325802d5e956c381a3b2791a73b9a6d4a6703dad656d9d4064d94885ba3ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764709957, "uuid": "8883d253-7d7c-4fd2-8a79-86053949c951", "comment": "Malware payload", "value": "56e87e8e94e017a737a3752efe1ae598f109c447", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764709957, "uuid": "e3219eab-a245-4d7b-9bed-d45570676f0e", "comment": "Malware payload", "value": "5d7697aeedd5bbd2a81ba6e917d6304302e77b4cc3bd41f81a045b19e28144208a8ffcf85ec63d0dc4100d6a06ac2016", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764709957, "uuid": "aa8cebad-dd1c-468e-a458-4a0c8d002e3d", "value": "T113C69DA97B003DE2D16FDA36C9A358951F613D1E4B76B6CB0C60769E0D733A1ED2AC04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764709957, "uuid": "7e29ab2a-7234-4999-b28c-f92397899eab", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764709957, "uuid": "5447011c-302d-494f-a080-9582b45f7d1c", "value": "49152:yFXjI7zZJmpMEe7dkOCJ2JzOfQDQGhI8hjj+OsasS1z92W8WX7yEX4yhSr9Wk60x:yF8xODCK8xw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764709957, "uuid": "52e98f4b-b3f4-4790-a05e-0e324be04f8a", "value": 12511744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764709957, "uuid": "528e6ec5-4249-472a-a513-d5720820a263", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764709957, "uuid": "537a0670-88b8-429b-a144-2133e9197a32", "value": "iop7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc4587cd-cf58-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764664047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764664047, "uuid": "f2e0f545-92a3-4ff3-9682-a98a8f011c7d", "comment": "Malware payload", "value": "07f3e575a4c916f00cfb057e94d9ac4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764664047, "uuid": "49822ae4-6eda-40b3-b2fe-49b46ff31d58", "comment": "Malware payload", "value": "24af632f54d2d01d59a4edc20ca7386c42a48055546b789a04444c31f79efd8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764664047, "uuid": "d38203df-4e9f-4f4a-af2e-8e2ea8c5ec75", "comment": "Malware payload", "value": "0ba82b75d0b0a846a307c8e8f5316e00d2e8dfb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764664047, "uuid": "fd48446d-976b-4446-a871-fa45426f1814", "comment": "Malware payload", "value": "82471c60991ce8d1a81ad7993d326f6afed43ffc80e84600809ea8268eeb5fdeaae4fa51095a1b5dbf695c8914b67681", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764664047, "uuid": "4c944b29-66b1-4a52-bb99-c0a0dc51bf44", "value": "T115D62323F24EA73EF45696350A629910883FBA20541ECCA3D6EC7E4CCE2D5601D6FE57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764664047, "uuid": "02ea69b4-817c-4554-88cc-58ae37e50ac8", "value": "e8ac1646024d52d1534a88da2e8037cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764664047, "uuid": "a72d3857-4d06-4e07-80ba-0dbafb447e84", "value": "393216:pDv1ID9dDxAMh+FZ6ch4gTmlfF/gBNpSK0ezJ:fID9dyYqZ6ch4REBNAK0eV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764664047, "uuid": "cdea1afc-00d7-4ef7-8842-5fcc88148188", "value": 13541945, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764664047, "uuid": "909ccb35-2d8b-4e11-af83-7ca7666516af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764664047, "uuid": "9a48c95c-2f91-4723-99b7-15f780bdf73e", "value": "which_browser-0.2.3 41-windows-setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e22e7685-cf46-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764656379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764656379, "uuid": "3fe4c099-74c1-4a91-8b05-b96bd209f02e", "comment": "Malware payload (Mirai)", "value": "edf21c9961cd782a8255f39ffa583fdc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764656379, "uuid": "fa7189e8-cc73-4d50-b682-ef547441ddcd", "comment": "Malware payload (Mirai)", "value": "24e05101d2be83ccece7c9a6db45977d663d6c80ae7aa3e403858c3931ffbcbd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764656379, "uuid": "b2830065-60be-48c1-a07d-2685d6731334", "comment": "Malware payload (Mirai)", "value": "65b88a359356a9ac9a620d61b17dcbdebe6c95f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764656379, "uuid": "5681aed1-7c03-4c1a-b0da-e2b68635faff", "comment": "Malware payload (Mirai)", "value": "2abf61cdda994ec17c2e4ec3e03302ced59c182fef555703f0b640503ad622996b25fc95af0d1ba545d975c606b36888", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764656379, "uuid": "ccbc94ef-e0ed-4ca1-8577-2819500c8c9c", "value": "T136630852B8C18E15C5D813BBFA2E018D33126768E3DFB2129D116F147BCA92F0E77A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764656379, "uuid": "558d3c16-874d-469a-8a0a-603d62df7fe8", "value": "1536:StnER4jL83+4/ZZM0mA8w7lR5vzq91dO0nz/IziSX+1/K:t4jo+6ZZBLbRd29P2X+1/K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764656379, "uuid": "a82c585d-f576-4f23-bc2e-12a142e0c479", "value": 70960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764656379, "uuid": "a3b6a011-17a1-45db-b5ad-79b75f5676e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764656379, "uuid": "38b5c595-78d6-44a4-a810-c55fa82949c7", "value": "jew.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df332d6a-cf46-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764656374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764656374, "uuid": "cda3fdaa-abf0-4a5f-852f-bfb1b85c3bef", "comment": "Malware payload (Mirai)", "value": "0e21c03306822733f4a25b725aa2a7bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764656374, "uuid": "1a30dda2-1152-4a35-aff3-fafb8a89ee5a", "comment": "Malware payload (Mirai)", "value": "27b4f94db3d278b134ab4e34de9bd8b4cdd8f2b64e326283b7d225f319758a4d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764656374, "uuid": "c8c30824-987d-4016-b845-b84319b5ceab", "comment": "Malware payload (Mirai)", "value": "6cbcc9f0b5a0510a4daa91d080549d875b6b51ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764656374, "uuid": "1a64c7d9-0ea9-42fa-af59-768d96ed4daa", "comment": "Malware payload (Mirai)", "value": "6ef9fff5124b91cdf06784a29490b5c434134576549f5110693a07d7ed7d82ad3ede3bbf43b31f4ba6a991652e3422b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764656374, "uuid": "e05fadbc-a2c4-4c22-86f5-70bf93516ac6", "value": "T15F73A70E6E259FBCFB9C823587B78F21965833D626E1C644D15CEA011EB034E741FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764656374, "uuid": "87ff8e1a-080a-4b0d-b0e5-087304b6d664", "value": "1536:zoVvPLWTs7ys6XcniEyNMV3sDmTRdVSabdza3TTLbwXmP5P:zo5WTm6XouMV3sDmTvVSabQ3TTLbwXmF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764656374, "uuid": "777098db-795b-4c29-939c-35fd400df4ee", "value": 75976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764656374, "uuid": "7bc4f565-eb4d-4133-b1b5-2020424e0350", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764656374, "uuid": "0ae3b47b-fd84-48d6-ae66-1d5780bb6d44", "value": "jew.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0cc5b9a-cf7c-11f0-a129-42010a9c0007", "comment": "Malware payload (Gamaredon)", "timestamp": 1764679516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764679516, "uuid": "0b78bdd1-afb7-469e-9746-17cbef6a6e8c", "comment": "Malware payload (Gamaredon)", "value": "3c2bb922c5f6ea504c373e254dc108d9", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764679516, "uuid": "6d002ee1-d831-4d56-8f41-b3b608a2d692", "comment": "Malware payload (Gamaredon)", "value": "28431f09c87116adacac29abcd65757f6416110c6ee880011664283ef9e1ec2c", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764679516, "uuid": "163d0aed-a022-4618-bd60-45a5d755330d", "comment": "Malware payload (Gamaredon)", "value": "54b698aad0bf797b2922aad634fa76517399e653", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764679516, "uuid": "0baa837c-8875-4462-9386-493ba2ff3151", "comment": "Malware payload (Gamaredon)", "value": "049466d13564f62fe34f8d0d893c50a3fa3ffcdbb6890be10b44dc9c750da22e7d54db6d4fdb2fce599feab8faeffad5", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764679516, "uuid": "9065dd0f-a97d-46e1-be50-98c07e94a8db", "value": "T107043B1BB80313D5C73A36C6C6C72287DAE899753A3614D2F43588A71617C69EB8F83D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764679516, "uuid": "1340efdf-836c-46d0-a11a-c97188daf651", "value": "3072:SRVRsRaREYmQM6gtV7s86aK9ywN+Dp7EreHeCeZsvhOZXN8fLhk/ukJ0Z5+2gdcH:PYmJ6raK9yLp2Ao98qe8dcarY0Lzt7TE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764679516, "uuid": "be1f46e1-a4f2-469d-aa3c-a571097da426", "value": 180667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764679516, "uuid": "4616a071-e1aa-4c35-8a5a-b91af0503a31", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764679516, "uuid": "246a0bab-f203-4b5a-99da-567b459dc55c", "value": "payload.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51aa0229-cf65-11f0-a129-42010a9c0007", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1764669451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764669451, "uuid": "c1d55d21-024e-497a-84f8-ef9f6fa9ca7d", "comment": "Malware payload (Socks5Systemz)", "value": "afab6b8ba19c70ddec165262dab71234", "object_relation": "md5", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764669451, "uuid": "e4df3739-29e4-4354-b5e3-ca43845fb331", "comment": "Malware payload (Socks5Systemz)", "value": "2867ea503ae13d8e9613904864da2ffdd3a9f11676c38ece8e0dcffded08e500", "object_relation": "sha256", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764669451, "uuid": "2798ba81-b75c-4ca7-9f5c-00ad61a7e5eb", "comment": "Malware payload (Socks5Systemz)", "value": "08e9db6a87d677e0bf4c1c31c42cca00a685728e", "object_relation": "sha1", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764669451, "uuid": "498579c0-f26b-46d7-80bc-84e9145592d0", "comment": "Malware payload (Socks5Systemz)", "value": "e6098002f7f31c61728c9b708b7b816700712beddb4f03dac7609ad7607e0342dcc8f478e6b3ee8fa0c5f671f7cd1799", "object_relation": "sha3-384", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764669451, "uuid": "da955c2d-bfa6-44bc-aab7-790a48c75d74", "value": "T1ACF53306627EACF5F0A5D5388F79D21355FC5C38AEE44512228C4DCEAE7B3825E463E8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764669451, "uuid": "8c53e26e-43cf-4dc5-b294-47ed9a65e340", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764669451, "uuid": "59b595f5-4fc9-4642-bf44-f19f21cffe59", "value": "98304:Ms+aZaalxVSyXTBjhk6F7pyZZakJ9OaoVW89I2XQFS5:LhZfPF9fFUZZnJ/oo89I2X64", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764669451, "uuid": "c0144180-a992-47f3-807f-06e5d069abcd", "value": 3437277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764669451, "uuid": "791b6ec6-f818-418c-af34-38c4c76ad541", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764669451, "uuid": "dacd5e88-c7cc-4621-b725-d289f1fce0f1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d437b33-cf5b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764665256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665256, "uuid": "58eec844-824a-41da-9314-48570cd9502d", "comment": "Malware payload", "value": "a1b74931b5acb5cdc0cc4c34a1e7eb9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665256, "uuid": "86d71385-b0de-4ebb-9182-ab661f7b7e23", "comment": "Malware payload", "value": "2882a5ff2d748941bbacfb24ab3935b8872d9e0713f57a7c724b9b82292bcffc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665256, "uuid": "66427ce4-51ae-471a-87a5-6c219bf72225", "comment": "Malware payload", "value": "c76d6e78be9086ae30ce49c45f59187bd2947305", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665256, "uuid": "abdf0acb-c90d-4a4a-9641-53ee9e7398c4", "comment": "Malware payload", "value": "4389fc44e43d9e82412277f03415ca2395b1f0f6ee37f9ae5cef6ae213b034d011ed09fecefe3355ba1d7ced3dfd4627", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665256, "uuid": "8ea511cb-f444-403a-b291-4756b86432ce", "value": "T18F94F6A3E24DC8E5D89212748836D82E20A7AD6D5FB1471E127DFE38EA73343546B707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665256, "uuid": "c9e52452-8cfd-40af-b780-c83027ec9e57", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665256, "uuid": "a0b480d9-d63a-49f6-98d1-479b41a52582", "value": "3072:j+KtvoZ37VnuTLKQqu6/6WqMV62Koyo7Jv+6nN4GwXRfJzIp2tG:j+MvoJieOQmG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764665256, "uuid": "8cc2ecac-ece5-402c-bf87-0e1bd3379cfe", "value": 415872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764665256, "uuid": "964ac39d-c592-49e5-8af4-6c8594bae345", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665256, "uuid": "297ba844-ff10-48ab-b711-51e612cc916f", "value": "ligedannethed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00727f2e-cf16-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764635385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764635385, "uuid": "31e7f6b7-c2a0-4806-8008-36affbed2b50", "comment": "Malware payload (Mirai)", "value": "9b3c71caec5dc8a520aa1001a1c73432", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764635385, "uuid": "f121a81f-8a6a-4609-9699-0c001f263957", "comment": "Malware payload (Mirai)", "value": "2b00437e90fff82323a0c2be035aad5a98899f9a7fdd644dc00d265178280b82", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764635385, "uuid": "016c0a52-c3b3-43f9-8c22-eeb08d041111", "comment": "Malware payload (Mirai)", "value": "62157385ac4314d968912b0285a1ff30f0d089d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764635385, "uuid": "6895926f-c743-4ef6-9862-44edb35b9849", "comment": "Malware payload (Mirai)", "value": "8d261a3ea9d32d1363059ec2f855e3485456c81899a2d12f6f9784c3ced25c6eea0262f5547d5cf406b02b33f7a7206e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764635385, "uuid": "9c4014cd-a9a8-4fb3-8151-5f299ac0d790", "value": "T10623F1528366A6B3DEB0F0B6B6FB4B42B68A5E64F4C5587323149B5C67433833879053", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764635385, "uuid": "db5bfe03-aa99-4418-82d4-6e583ceb8bd4", "value": "768:+se5KqV6ce1+O1CjE0abcqr9xm4j8dKIVVK1Aq5HU+Cl5zlWg/ABbDM0r9q3UELk:+DAJ71l1CjE0abcqr9xms8nQp5HXCliT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764635385, "uuid": "373e07c3-d534-448c-9b53-2937d4c831f2", "value": 45924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764635385, "uuid": "13b8a0e3-05b5-42be-b8ae-a24d92552182", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764635385, "uuid": "5d219285-77bb-43a2-99da-c9b46d67574a", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ada18408-cfa3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764696234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696234, "uuid": "90c16133-1b4c-4125-b9c0-eccaac509bd6", "comment": "Malware payload (Mirai)", "value": "dc8d2257dee84487d99859b45a143059", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696234, "uuid": "8e08c598-b918-4846-9fe4-c00b1eb78dca", "comment": "Malware payload (Mirai)", "value": "2b1a566355a6574e0b0391ef7d73caac9c87f3b3decba76b0814f5d52dea9475", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696234, "uuid": "4556763a-5806-4150-952e-6fb49b00df66", "comment": "Malware payload (Mirai)", "value": "c1b64f2472e0431037955fc5a206f171a2c7eb02", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696234, "uuid": "8e6d0a9e-da83-4ebf-81d1-f801c5a05229", "comment": "Malware payload (Mirai)", "value": "7b2295349277c7efa02e381e0d32cd3c7b6997e81c0dbf88eaac504083f0d2ed37e79faf64b46844bb8d9d194d4106c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696234, "uuid": "eeee39bc-af56-406f-bef4-cda8bd571940", "value": "T178D32B06B30C0947D1632EF43B3F27E093EFEA8121E4F641256FAA4A9171E365586EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696234, "uuid": "160557be-86ab-441a-ac69-8e00db65c86e", "value": "1536:Lr2ePsGIcBxxwY719tUt3/BDcDHJgCX98ivAM46RSquyQB2AkqcPCbL8f:LVnxwEkCDpgxbMx0b4f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764696234, "uuid": "4bd3a3e4-4075-4b4f-8108-d68261416f00", "value": 142412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764696234, "uuid": "1d96ed88-b1d6-4ce9-8682-755002cb347c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696234, "uuid": "6d542322-b1d5-4a8e-9186-884e22e8c32b", "value": "nshkppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d4339fc-cf94-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764689523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689523, "uuid": "8041ea83-7fa3-4b6d-a12b-b47f27c06bf9", "comment": "Malware payload (Mirai)", "value": "190f138fcd89df3987baa7774ed775a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689523, "uuid": "43c97b14-2b34-42c3-8905-55661b5d1780", "comment": "Malware payload (Mirai)", "value": "2bb60370f6ae1b1e4655d04d2e64f8b444dd6be11f3db1adedab980e07e03529", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689523, "uuid": "a963a603-782f-48be-a318-d43db396e034", "comment": "Malware payload (Mirai)", "value": "f8117124a6b8d8b722ee1a805aa2ce361dba72b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689523, "uuid": "dde18e7b-9758-42dd-82c5-98f62806ae54", "comment": "Malware payload (Mirai)", "value": "a98732f33984823451025c28977f4341d6e16b0288507ac81ade736f2d5be9bb06f62feff3bf6c0eee94794796c09d83", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689523, "uuid": "6faade9a-092d-4219-a8d9-9859a2050448", "value": "T17524AE62D877ADE8C6159274B0F0CF3A1B53A44441476EF6A9EACB388047ECEF5097B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689523, "uuid": "51d43b3d-547d-4bc6-931d-700ca79e82f9", "value": "3072:ewIvrRxNu33ZTaVXeebE8jej/TEgDgekgQtj3WNmS7UxK:ewk63ZTo37ej/TE6IjGNHUxK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764689523, "uuid": "f80591fd-a6f8-4ee0-ad6b-82e1ef285096", "value": 216032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764689523, "uuid": "d022999e-9185-4c8a-af3b-cdd72b9d9dee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689523, "uuid": "fd344502-3a28-4a9c-8b4a-4d2862bd828e", "value": "ecco.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f470bc1-cf5b-11f0-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1764665233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665233, "uuid": "264959aa-deeb-48d5-8eea-8d99164545fa", "comment": "Malware payload (SnakeKeylogger)", "value": "60d88feb54040cac9adb74e3af322c3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665233, "uuid": "c50b5b4e-7e55-4925-80ce-2230ee7d5c9e", "comment": "Malware payload (SnakeKeylogger)", "value": "2c1c1e5c6028ca269261ec084975bb58a0a4f6b3e72bd377f6cce0b961b2e5f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665233, "uuid": "1a410c75-c1a8-41aa-8afe-59d183a0882e", "comment": "Malware payload (SnakeKeylogger)", "value": "13a2dec9f98e525172c90bdeff038b9a17205637", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665233, "uuid": "0faff6cd-7087-4a3d-8cdf-548e4ebb359b", "comment": "Malware payload (SnakeKeylogger)", "value": "e024be0411299ce1ee1f305b6fe2e1376d18d789578250db9f219f4a0109e92b4babc819260e75d1e5593d5621b92ea0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665233, "uuid": "5e2d9cc3-1bc4-4f88-8eb2-de98724457d6", "value": "T17E44948A6FE89811E6FF843792B1C014C6BE7463456E8E2E16D1F8193A3D954CF0AF53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665233, "uuid": "17940b2b-28e4-4cad-9f46-c0854fb1baac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665233, "uuid": "195f1ade-9d77-499c-9f5d-3b4700586169", "value": "3072:qV+MRom5yzj+jgmpY57ThVrlzTgPs3Igt9rSN4gEjG0y2Ukb7J5AMs0IZYTVgfi5:5qOZQN4Ry2Ukb4hzb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764665233, "uuid": "9b8d199b-2ba8-468e-83b1-0787b3b6da7f", "value": 275968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764665233, "uuid": "62a824a6-c779-489c-9d9f-c157df039ad7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665233, "uuid": "9eb97d08-3fc5-4a9a-a144-36eb1276b1b4", "value": "FACTURA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a5812e5-cf4d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764659131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764659131, "uuid": "cf885317-bd74-47bb-a35a-835905b79505", "comment": "Malware payload", "value": "b22565498be3cf604dfc61c08c219d3d", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "bookinge-netlify-app", "colour": "#9A7F8E", "exportable": true, "hide_tag": false }, { "name": "nipple-smartvault-com-ng", "colour": "#96B7AE", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764659131, "uuid": "a35db9a2-480e-4c3c-bf48-b1f270828bbc", "comment": "Malware payload", "value": "2d0a3fc71b6631117963f26a0758e246d7346a2d7f473f81d28a07ffc119632e", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "bookinge-netlify-app", "colour": "#9A7F8E", "exportable": true, "hide_tag": false }, { "name": "nipple-smartvault-com-ng", "colour": "#96B7AE", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764659131, "uuid": "3851174a-b0df-4b84-87e0-4ba46ec17092", "comment": "Malware payload", "value": "bcf956307cf05c9dbf487ff89089dd0791ce1131", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "bookinge-netlify-app", "colour": "#9A7F8E", "exportable": true, "hide_tag": false }, { "name": "nipple-smartvault-com-ng", "colour": "#96B7AE", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764659131, "uuid": "0386a0c2-89d9-4fd1-899c-759661af2240", "comment": "Malware payload", "value": "5124eeb260db6deae77b0f2a843d5873d6d10bd0320c30ee48b1a441a8e254d53401a17ebf831e443cd58dfae298502d", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "bookinge-netlify-app", "colour": "#9A7F8E", "exportable": true, "hide_tag": false }, { "name": "nipple-smartvault-com-ng", "colour": "#96B7AE", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764659131, "uuid": "64ad3310-c125-4734-8013-ec3618d67162", "value": "T16CF59A9A6CD8EC7656A91BEC374208377117595AF0EA3047FAA31CC60A7D8C066EDFD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764659131, "uuid": "2204e53e-99c1-49fc-b190-8044d1353094", "value": "24576:Mbwz4ks6TkUA2Sa+CjRKKw08e8q3vzZQDzwQFzp7vM2Mkai:Mbwz1s4oujE1Y8q3bZQPz8kai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764659131, "uuid": "9ee22f02-653e-4785-a642-35beb9ab107a", "value": 3325299, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764659131, "uuid": "f3822a7a-df80-484a-8567-72176bd4d68d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764659131, "uuid": "b7095fb3-2d90-4b1c-a3bb-4e223ee1e41c", "value": "ptjoeg.PS1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a495a60-cf5b-11f0-a129-42010a9c0007", "comment": "Malware payload (a310Logger)", "timestamp": 1764665198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665198, "uuid": "e64134fe-a36e-48bb-a89c-6160f89e5198", "comment": "Malware payload (a310Logger)", "value": "bc79f67aa2c484893be13528eb641105", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665198, "uuid": "b198709a-7911-481a-a751-e93039baa43e", "comment": "Malware payload (a310Logger)", "value": "2de4671af96bac2cbb7added8ee3a54239aac63a56d4bcc5ca22bfa88b30eb48", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665198, "uuid": "aa5ec00b-ae5d-4cb0-821f-cd160ee2a840", "comment": "Malware payload (a310Logger)", "value": "f67bb4e49871d45cc5458c85f81751c9a04a68b0", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665198, "uuid": "175c0365-1364-44f4-bd93-a256e79a6de6", "comment": "Malware payload (a310Logger)", "value": "3ad92b285c743afca28b35f8095b6d2fc705e949f4a23afaa02474b2248f94228b5292b2aa78c69938b664405bb17f3f", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665198, "uuid": "784c6769-a349-4849-b43b-fd9982f57d8b", "value": "T111052370836DC722D8E16BF10621D37183766E9DE421D213AFCE7CEBB656B189A84713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665198, "uuid": "bd49ddd7-3699-43b6-81bf-a0901a8955f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665198, "uuid": "b3e68f3d-6d76-497a-9c3c-81ee56b7c980", "value": "12288:T4dPVvAe/3DBfw8HfXpzU4VnwYkOrfXwaztpZzWt0OfzET/QWhB16s1yDJNtRE6O:T41VvhnHhzBvkOrY8zANfi/zH1mI5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764665198, "uuid": "34418989-032a-4d6f-9545-13e57138f88f", "value": 837632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764665198, "uuid": "9e9e1b37-3168-485f-a521-235452be3638", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665198, "uuid": "9f287b30-7509-4383-81b8-d4f2c3b1c72f", "value": "0102471-.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ba056e9-cf8d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764686514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764686514, "uuid": "e0c3606d-5495-4dba-9a04-b115cfe94763", "comment": "Malware payload", "value": "740a80a9f2ccd20fea58efe87c79376f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764686514, "uuid": "8b431af6-4055-47fd-b584-5a2577ad7025", "comment": "Malware payload", "value": "2eae68ebdc4c53a4faad79d9399fc378084b14498e5d2998187ca79fb8c3940a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764686514, "uuid": "744cbf06-1d88-4008-92ea-6980321e3921", "comment": "Malware payload", "value": "b5689ba582036ef42333e0ff0676d704084df4b5", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764686514, "uuid": "dad2f644-e6f8-4e9d-8347-fd5029833a51", "comment": "Malware payload", "value": "06d9eb5b55ee8d795890821b9e5b259c07cda18d1af53f4d3e00d02bb5a786e7f71f1711d7a93a81c7649c0951b27b66", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764686514, "uuid": "e6179ad7-bf6d-4dcd-89a5-b2391e0207af", "value": "T164F62A362AA26DE9C7639031C576DB106B7341B16102EAB9DC35D3630CA5DA6CFBF42C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764686514, "uuid": "64cf4d9d-4f88-4c32-8f26-18d5296e15ab", "value": "b0d80618a86490cb14b81d7650a23df3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764686514, "uuid": "ec1915f9-8888-4044-91f5-03ecc9b413a9", "value": "49152:z9r1gDVK6EkWA+fdPlVMIpJpRxya7Y7FtYq8hsjNfMsXYaAId3CgwyhMg+8iOb5I:YVmmY8NfjhLAsYDIEWa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764686514, "uuid": "9c48943a-0c71-408d-967f-b79b24159633", "value": 16671744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764686514, "uuid": "ca3cfe9e-4d0d-4cfd-a88e-514096b60913", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764686514, "uuid": "bee4577f-b0b1-42a0-bf0a-301a347fa0da", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcaf91d3-cf6d-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1764673067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764673067, "uuid": "f918c260-4e3c-42d2-bae4-71982501fb12", "comment": "Malware payload (RemcosRAT)", "value": "0556be65eceedfd1f90e28e564534a7c", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764673067, "uuid": "2c522b86-4a95-4983-9516-a5e2a290bb25", "comment": "Malware payload (RemcosRAT)", "value": "2ed6ced5d91a3ac5acd54be2d1484bb5f6709fb588bff3b0553261b40e8bb3c9", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764673067, "uuid": "a76e2d3b-cf73-418f-a870-4b411712b1e1", "comment": "Malware payload (RemcosRAT)", "value": "9cb2da400e0f8e2c5dfe623ea82dd73f24b9b100", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764673067, "uuid": "56419921-cb76-4439-bf7c-630dfb339fe1", "comment": "Malware payload (RemcosRAT)", "value": "c2034858bbe37c17fc588589bf73bc67d1a619e156a7c76166de33aea943d5d950e56ee5477ec520087e287e3a832558", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764673067, "uuid": "9c44f97c-e8d3-4321-9650-33c3e2c55ea7", "value": "T106253396BDB38FD88E4F39DB9BC1102885E664534C7808EBF2099BCA7E9935DC631174", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764673067, "uuid": "1ff5e2b2-a34e-4bd3-b435-1fcf4399251b", "value": "24576:vL0q+aDuvxrjDSyv1m66iPZxeDys4i1ps8VCR:vLz+kuJ3NzfRxemIps80R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764673067, "uuid": "b4a8857a-8931-451d-990c-63ba1e2b7e00", "value": 984107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764673067, "uuid": "c718c09e-ed5f-4a04-8f81-496a3518a39e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764673067, "uuid": "967a86fa-8be6-4b9f-8c69-7ddc7317b767", "value": "tour 18-2126.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4b8521c-cf7b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764679120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764679120, "uuid": "18a5eeb6-8185-4571-9b9b-c10c74031b38", "comment": "Malware payload (Mirai)", "value": "94041b89af028684c8d1cbde50610df5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764679120, "uuid": "0efa32f2-e501-49bd-bf7a-2af3a3e1d1d9", "comment": "Malware payload (Mirai)", "value": "2f8fa66fb2f02b94c5bbfe5974381ea0a3cb82e74b319a18ff60e76eacdbda37", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764679120, "uuid": "7dc76945-195f-43fb-bcae-60366f5bc399", "comment": "Malware payload (Mirai)", "value": "b29f38bf8945b5121565d4c050d17d0218c04907", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764679120, "uuid": "d2c8d106-9796-4f58-bc92-f53db9ee1daa", "comment": "Malware payload (Mirai)", "value": "c37d29c544f23d9e34cf80c233e4e4284d773583b7e85816e12d3bb08d3e9cf2743da76d3273c5835ae8716efe614b3c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764679120, "uuid": "94738b6f-2b87-41eb-93fc-dc8919fc233d", "value": "T1EE530267C9252A18E3FEB03026962DFE5035D919B3F84FDFD6D0AD9F9812D1A1A6C00D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764679120, "uuid": "915d900b-68bb-43fc-9281-858f8bb1a187", "value": "1536:BnZXWAN4Ka83hTxmBWRKu43t5ACIf8vM0Ltlf+MGLEWoqHInouy8Hy3:fXSgXmBWRsdzIf8EiGLTtHgoutM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764679120, "uuid": "9ae454c7-2774-49d2-bdd8-5eb471aae528", "value": 64584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764679120, "uuid": "f8ba37a3-eee3-40c3-a8a8-909c9a895b6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764679120, "uuid": "ce33fcc9-c4f5-41f0-ba93-ef56ae1f66e9", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "928e711f-cf61-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1764667842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764667842, "uuid": "f396ea45-d62d-47af-8218-2d7a021cbe8d", "comment": "Malware payload (Formbook)", "value": "60e0d4abb8a3e0e30a8dabf8e022f4ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764667842, "uuid": "e1f86d92-8453-4f0e-bbd7-5d6e1ac94645", "comment": "Malware payload (Formbook)", "value": "2fc8ebc45314f2d1c8d20b5fc37ae564d04f066fc09cc46c7cf8a41ce87c781d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764667842, "uuid": "e234843e-807b-4a2a-9051-20a32967cca2", "comment": "Malware payload (Formbook)", "value": "b99e83109534dee89de55856b5b6548ef3afe889", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764667842, "uuid": "10673f1f-57c4-4327-8f7b-40db52d0fc49", "comment": "Malware payload (Formbook)", "value": "7964b55038cdbc8c78bdbfda78bcdea6cd3ea3388065fab759151683a12206a662aa9a500f0ca33a1cb35f517c40091a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764667842, "uuid": "ce9ed94e-d8ec-4eef-b7c8-3b2c8af71f44", "value": "T102E412956259C616D4612F705DB1D6B02BB8EEAAFC12E21FCFD92D9FB07E3110C58223", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764667842, "uuid": "022ff518-6980-43f9-af68-f4a01e18805c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764667842, "uuid": "51a67b3d-1f46-41b0-a71e-9bfeb0a28fb5", "value": "12288:vNBdnT51PL7C9WheRZzqnIG4ysVmZvozXhLzjNZKgZZ3fXe0F1+GKGQr:f9vC9WheQIG0VAoLh7NZK61X6GQr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764667842, "uuid": "725c8187-9cc7-43ef-b25c-966045e86cd2", "value": 662528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764667842, "uuid": "4423caa2-ae7f-4fc9-a834-3783aa1775ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764667842, "uuid": "86a0ed6b-7338-4efa-bfe0-3937678f1dcc", "value": "SecuriteInfo.com.Win32.MalwareX-gen.42333316", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91ab88cd-cf46-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764656244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764656244, "uuid": "1020519a-e46e-44ad-b454-7beca694604f", "comment": "Malware payload (Mirai)", "value": "63e61d3febbeacbd531ff47ad6f46718", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764656244, "uuid": "40bbb308-cb24-42f3-bda9-5d9f78afbb4e", "comment": "Malware payload (Mirai)", "value": "30614a68da50c07a2be8581da34ced70615ebf2a5c11fb7c05fe51da8d4e92a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764656244, "uuid": "d6c32a77-2f13-46a1-b0ac-0e75e0e0f9a1", "comment": "Malware payload (Mirai)", "value": "44a4282488eeb0c3297a7e998609672e15215e37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764656244, "uuid": "f82215ac-b23d-4fd5-b83f-a173843cc7c0", "comment": "Malware payload (Mirai)", "value": "5f04dc162bdccfdb4894c8af4635a487be32ed42571f6cb70ca1cccf51609a7f25628f06f6fdafa06c98aa1dd0ae1977", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764656244, "uuid": "9a7df2e4-bf73-40e5-8369-4c266eb7ddd7", "value": "T139831A05E6108B5BC1D127BEFA5F425D33276B58A79B73125A286BB43FC27AD0E3C121", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764656244, "uuid": "46fbaee7-b711-4a92-bfda-f7baf04f8087", "value": "1536:TjnsGHHgfbWkNO1U5LDKXrc7I+ikPxHEEGRHNl1XXsO2kial71XHB:ckHgt41U5GSPxHEnRHxsO2D+hXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764656244, "uuid": "39720f93-a4d6-478f-9004-2952c6c1c619", "value": 81213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764656244, "uuid": "8fbe271d-e9de-408e-9fc4-2e009b95950f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764656244, "uuid": "0f9e2072-4f88-49bb-aae0-539fecfb5383", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d52c137-cf7d-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764679779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764679779, "uuid": "ffdd5be5-1dc8-4f62-8573-7a8c237992ba", "comment": "Malware payload (Gafgyt)", "value": "248181654370cf6dc7069784d9232d97", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764679779, "uuid": "54056446-2203-4ae9-bf2c-129510d24976", "comment": "Malware payload (Gafgyt)", "value": "30b8f5b4b71ca5da14b55698fa262be8e7f875fd54e10acff2ecaf384f2d524a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764679779, "uuid": "c84e45ac-0821-4314-aee3-43c115a9dcbe", "comment": "Malware payload (Gafgyt)", "value": "8badd73c9f59cb76395820e80119892f8e838669", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764679779, "uuid": "410a3520-8ad6-4380-a739-82dbe8509d53", "comment": "Malware payload (Gafgyt)", "value": "eb3dcabbaaa690863e99d1ca7959cda009ac5ee64c71817b008896a270578860bbe85cbec2d8d421019da0275d6ef73e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764679779, "uuid": "fce4937c-08ee-48c2-89b1-4f696137eb1f", "value": "T1DC53F83A2B131F63C4CD017205F30336ABBAE65D7CBA8B57E8A06D646F05A9434563ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764679779, "uuid": "4de1d127-3032-48d0-bdd6-1f1b11cc80ee", "value": "768:rIcmIHA8jHH3oh6PBWyWyLsVzQqwwf0WO+E3sMsau4Bb3Bpuxw:kc33oh6P+VtwwfPOu4oxw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764679779, "uuid": "d5087eff-9635-49e4-b7e0-c8c5cf1716b0", "value": 65553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764679779, "uuid": "3ec36e60-8e87-4962-b9d2-9335ac66d554", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764679779, "uuid": "094747dd-1849-4c8f-869d-54e5787a2508", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e2f140b-cf5b-11f0-a129-42010a9c0007", "comment": "Malware payload (RedLineStealer)", "timestamp": 1764665285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665285, "uuid": "f365004f-ac0c-470a-865f-13db236d0f5e", "comment": "Malware payload (RedLineStealer)", "value": "9bbcd3c3039db46f775970e80d8c97ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665285, "uuid": "33ba4753-7289-4fef-854c-20b9df660322", "comment": "Malware payload (RedLineStealer)", "value": "30fc332152721b4e56182d35541f656ea8f9b2b281dce56bbd867c05d9ac5a70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665285, "uuid": "64aec418-3364-4342-bedf-21f63747b366", "comment": "Malware payload (RedLineStealer)", "value": "116d831b2a5289ead99261532222f8bc5ac62892", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665285, "uuid": "da6dca9d-34bd-411f-89e7-3de82a20dd8d", "comment": "Malware payload (RedLineStealer)", "value": "c2c1306017f1142f932cae3605fe13e150be87cc8ef3ce4009abd53abc7185090ce5e4ea2c42132e6e70cf37d07811e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665285, "uuid": "c7a24fcb-61a1-4e1f-bba4-3615b447d115", "value": "T17445BE027391C062FFAB96334F5AF6115BBC79260123A61F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665285, "uuid": "3da1c9b1-f1bd-4b0c-a4d3-3343e349b79b", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665285, "uuid": "c9ec9237-e98f-450e-a97e-4c1e53827b04", "value": "24576:Y5EmXFtKaL4/oFe5T9yyXYfP1ijXdaPGq4l1rBZ:YPVt/LZeJbInQRaPGqK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764665285, "uuid": "1d6d0215-215f-4b41-b95f-7c95deaf7537", "value": 1200640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764665285, "uuid": "cde386bc-987b-493f-819e-e83af53c5b35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665285, "uuid": "40263b82-97c5-4f94-929e-896081ab4ee8", "value": "TT_06844-6843.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a29f7454-cfa3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764696216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696216, "uuid": "969e39c1-6514-4b0a-a98b-b8b7af729fad", "comment": "Malware payload (Mirai)", "value": "55092a8cd4cb7e31ee87e48e9231f76e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696216, "uuid": "dde470cc-c006-4ad9-8f3e-5a600ac9900e", "comment": "Malware payload (Mirai)", "value": "31722f28689cabe00e4fc16e3c1701f9368381da06bae3275223d423eba0eb2f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696216, "uuid": "fb89aee4-abb2-4cd4-b811-f1ba0e8a77cb", "comment": "Malware payload (Mirai)", "value": "c6a09c4b7253b1dc8099dd85f6e7ee6d325913ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696216, "uuid": "a8ebc34c-ffba-44e4-99c6-4c5bad0ee54d", "comment": "Malware payload (Mirai)", "value": "f15b893fb666a7876e5aa0b77c7a067257b58d8bfeceb55e6fa1d646d2516653dbd4d2130843116c93a3e4d2fc916320", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696216, "uuid": "ddd85c89-288b-411b-949d-57db32356ec8", "value": "T181A31905B9819F12D4C621BAFAAF415933136FBCD3FA7102DD20AF6427CA9DB0E76512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696216, "uuid": "28a1feff-2327-48bd-943c-ada76f5dd506", "value": "3072:QQNFhTqLFiZaOs/oo0L54yjoVnoWQkob:1Nn0gZaOs/oo0V4zVoWQkob", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764696216, "uuid": "27439fa3-c4db-45c2-80d7-fbf46baf1102", "value": 99264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764696216, "uuid": "b1823880-d289-4112-82b9-e6020ff21c5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696216, "uuid": "f2bde8aa-1da9-4bf5-ae74-887ae584b494", "value": "nshkarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7906ccc0-cf53-11f0-a129-42010a9c0007", "comment": "Malware payload (PrivateLoader)", "timestamp": 1764661786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764661786, "uuid": "03c9dc29-e398-4d5e-855b-054bf60dbaf0", "comment": "Malware payload (PrivateLoader)", "value": "a868ecc09907a7f1868cbc8c165a4fe8", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "flystudio", "colour": "#D3D460", "exportable": true, "hide_tag": false }, { "name": "KRBanker", "colour": "#52C515", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764661786, "uuid": "b4406d72-82cb-4ec1-8187-1ee1d020aa96", "comment": "Malware payload (PrivateLoader)", "value": "323514126c9e88ab371457383812723a5bd25aae47c113c990c9561afa0cf3c5", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "flystudio", "colour": "#D3D460", "exportable": true, "hide_tag": false }, { "name": "KRBanker", "colour": "#52C515", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764661786, "uuid": "a161eb6b-6f88-4e02-a961-074dc4992bcf", "comment": "Malware payload (PrivateLoader)", "value": "1cc64736fd7dd8e31262dcba4aed761abc2b2d48", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "flystudio", "colour": "#D3D460", "exportable": true, "hide_tag": false }, { "name": "KRBanker", "colour": "#52C515", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764661786, "uuid": "da8c5e40-d7af-4a0f-96fc-ea0bbe44a47c", "comment": "Malware payload (PrivateLoader)", "value": "14b521740075cd401636ddbbc6ad276e959a343059e2e4dfb841a00b3bdf16a31a6372a1e1e07d0208d52bd9fcdb207b", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "flystudio", "colour": "#D3D460", "exportable": true, "hide_tag": false }, { "name": "KRBanker", "colour": "#52C515", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764661786, "uuid": "d4ca4ece-57a6-413e-8e24-c48c5fdf7cef", "value": "T1856633735361104AD8E58C39C537BEF530F657268A52BC7860F7ECC226135F6A21AAE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764661786, "uuid": "bd0e0638-97ce-4517-9359-107454d0f96a", "value": "829199f933dd759d6df7591b9b73337b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764661786, "uuid": "9159025d-8de2-4486-9292-8b340e2b5ad0", "value": "98304:5DF4XVFWlbqfM6wiHWuucZyI3I6ETJztqnfVbLLYI5NbSwPh/N/L0P/b4iefa7f:xFQFMek6/HJyI3I6ENabAKwr4Xa7f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764661786, "uuid": "e674c4a8-abaa-4e1f-b181-19985ebcc097", "value": 6758400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764661786, "uuid": "38491472-6243-4a00-926a-d8c2cb5626d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764661786, "uuid": "221d4499-08c5-4fdf-8483-511905484539", "value": "xiazai.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0122a1f8-cfc3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764709689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764709689, "uuid": "915c351c-d7d8-4d71-a611-0ae8f7d3127a", "comment": "Malware payload", "value": "b3c24d7bed91a6faecc2f1e1b9126111", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764709689, "uuid": "da8ade4e-793c-4635-8392-29787273121f", "comment": "Malware payload", "value": "326bec0147517a2735cba6dc1604d538f33cbc5ad82a3cf24585a00940bada0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764709689, "uuid": "c58289e6-5556-4b38-bc3c-4f26f737e2a1", "comment": "Malware payload", "value": "7bffa3ab02f3788bde855aeb3104aeb217b84968", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764709689, "uuid": "faaaea0e-10d4-4937-ad25-3d5559940abe", "comment": "Malware payload", "value": "b890fa34911d871fe648ae83b5d0eac5a4060f75d3a4ab4b88c72b3ff98f49a0682aa975f4dfc88611fd8391fd51babe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764709689, "uuid": "b11d7e98-2dba-46c7-a226-0c0fd6f9c3b9", "value": "T1DC743B1267B895C1F173C17C26A3E613E27A3C0997A4B1AF96E8DB0B23D1B07768D711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764709689, "uuid": "723a10fb-8740-4260-925e-c425d62a0bd6", "value": "ddbe5447cd49bb377ed5d9a16ff59e87", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764709689, "uuid": "a4bd1177-0616-46b8-a0c6-a3af4569c47b", "value": "6144:1Vv8Z8uwE2APTOYruU/3T/K0X+sjjzQvYEhxfPNJHd+s66:38J6UvGciYEr3N2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764709689, "uuid": "11286cde-b095-428f-8c43-c18327b7f745", "value": 365616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764709689, "uuid": "515af90f-2a0f-47f7-846d-10c1d093c47e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764709689, "uuid": "7cb8069b-1626-4fe8-a458-9bbac5f7222c", "value": "TeamsSetup_v7.850.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "099b2544-cf94-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764689517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689517, "uuid": "97bd5d66-084d-47cf-b7b5-15afb3de08fa", "comment": "Malware payload (Mirai)", "value": "b1661696e791334efb3b5c5a0e1cce56", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689517, "uuid": "677750c8-07df-40b3-8393-652691ea3e69", "comment": "Malware payload (Mirai)", "value": "3410b5c3819d7bfddaaf987b93ca75c82a8ea032cc8b0cafc92c5540ae22a312", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689517, "uuid": "7af38b57-6d40-4e34-8129-2e42f91d5900", "comment": "Malware payload (Mirai)", "value": "312ff7b7752711d3f20613136ecf51fa0b486f40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689517, "uuid": "50cbfa53-dc0c-4ecb-bed8-eb55eb775612", "comment": "Malware payload (Mirai)", "value": "0f2fab63e2a68c550d891b0ce9325a1328970841cca491fce76d355b1cb6ea55a3a1bc3e7d0e443ceb3c2205e0e6e065", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689517, "uuid": "92d98dd4-6c5f-4ba8-845b-c0c694006cab", "value": "T1C6731297413A9417C7AEDF3D76A4BC82377ACEA65D4DCC8934868727F49090EA70188D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689517, "uuid": "9c48230b-c317-4d48-bfd0-c7a55dc97e28", "value": "1536:2GG+ze7ogexZKitjLL3RqmaoCOPeFcqqd+PV/5384u+qgw09L:2GG+zPZKgfBBd+FGd8V/x84u+qgw2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764689517, "uuid": "fbf1bb85-da11-4402-b396-972bacc93498", "value": 79580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764689517, "uuid": "a225eff2-97b9-48fa-9332-8af5d2c877f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689517, "uuid": "cc774561-8c1b-447a-b313-4255b7df9ac3", "value": "ecco.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08abd22d-cf3b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764651290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764651290, "uuid": "16a3a7db-cc75-42a9-bd90-2ab9c7559c0d", "comment": "Malware payload", "value": "c95ee38b94d03b01c9ff48d411364d96", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764651290, "uuid": "8195fb30-8e47-4de5-9f45-509e92bdc966", "comment": "Malware payload", "value": "34748b1afa2a06452233a04302b117b86fb25178fa05eec5fdf1f7453fcacbe7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764651290, "uuid": "91bffbbb-2cbe-4ea1-9f81-65763bb6abef", "comment": "Malware payload", "value": "410b13c5096182db62aa01bb576a688770db1ead", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764651290, "uuid": "009c4c20-865a-4f42-a66e-2d5d378bda85", "comment": "Malware payload", "value": "91655d79fad826ce6b6d2b9aae27aa86814d8ce40f4d25a713114a131c9cb214832a52bbb9a5ed695b44dfd430979349", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764651290, "uuid": "bda9c387-a49e-4592-b707-3152befd9d7d", "value": "T1D1735BB43A4F3C81E3CBD37DCE454A62B11B79B1C666D2F0BA12532DC5DBCA989E0511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764651290, "uuid": "8c57a690-ddd8-4dd9-8179-255d7aabc0a9", "value": "1536:ASsARtxpHx3iuCswWBqcAj1WXZsgNbHvq0R4+UaPe:LxpHx3iuC1B7EXZjI0CVaPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764651290, "uuid": "48a95499-92f0-4782-a13b-d809997abfd9", "value": 79632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764651290, "uuid": "10027d45-e2fa-4401-b52b-b5019793b0b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764651290, "uuid": "c2281449-f48a-4431-a079-fb1819cb899d", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d105ce9-cfb9-11f0-a129-42010a9c0007", "comment": "Malware payload (OffLoader)", "timestamp": 1764705414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764705414, "uuid": "74ce007e-a7c6-4c0c-8c2e-62abd2f6a964", "comment": "Malware payload (OffLoader)", "value": "8147d7123865873d778f3b4dc2e7e366", "object_relation": "md5", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764705414, "uuid": "a4264d82-6f3b-4805-8bea-ae1c3d70e1c9", "comment": "Malware payload (OffLoader)", "value": "36d3b0214cb5431b133eb6ccf3ef77e32471e97860e9f021f3fb6a1bec6182e7", "object_relation": "sha256", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764705414, "uuid": "02a161a0-8ee8-49d5-ba0b-bcb38e695534", "comment": "Malware payload (OffLoader)", "value": "0fff2611b524bbe0988a664eccbfabe054357271", "object_relation": "sha1", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764705414, "uuid": "0e898707-c148-44ef-8522-1e75d7ff5ada", "comment": "Malware payload (OffLoader)", "value": "ca201f80aa7ad51e9952b2d882ebc7feae8130f597210db86658e592901d83754b7babaa008b27c43704358e50eb62bd", "object_relation": "sha3-384", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764705414, "uuid": "3ff45f77-75ae-46e7-a475-8d152297081a", "value": "T157460223F38A667DE06A563749B29211993B7E11661A8C4797EC384CDF3B1A01E3F353", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764705414, "uuid": "ef387bd4-4cad-489e-be3c-68d9d55ad30d", "value": "98304:TN66/qsr0VZjngxhpDwBOBfKt5yLFxNTZB7ktTq8K+ly8DfIbhGSqzx/:jyhVJgxbDw/tyd3w++lz0by/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764705414, "uuid": "09520085-bd48-4fe7-9364-bd72dc0cdacd", "value": 5628716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764705414, "uuid": "c839a60f-db1a-4c09-8152-a02fc639081e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764705414, "uuid": "b3d09400-e15a-4fbc-a237-bfccaaeb079c", "value": "ImGui.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dd4e3f3-cf2f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764646252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646252, "uuid": "8d534a44-c933-4a62-9f9c-80ba9a5e9f34", "comment": "Malware payload (Mirai)", "value": "b0d2ae1e8f187fccdb1957eb556d589f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646252, "uuid": "2c9ed646-b0ea-4880-b25a-3177a92b105a", "comment": "Malware payload (Mirai)", "value": "3708ee6f195c922af1fca70d163e1d443b731c4756ecf90190b23d93ef2cd26f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646252, "uuid": "90234011-8579-44fd-88bc-7a743d942818", "comment": "Malware payload (Mirai)", "value": "59a9df58daa37dc64e36e45caca65982d3afa630", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646252, "uuid": "b7085dd1-bb22-4df7-9469-e2b5e6c6fe34", "comment": "Malware payload (Mirai)", "value": "2da567a3eea2fc3c02d4da40b80008a8ff958bd24f2f8534b1dbe07f8f8663c6df826ecc812fe9e77309457df1d9836e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646252, "uuid": "67816d59-4439-40a4-ae4b-03a9293c1b86", "value": "T115839316BF601FF7EC9ACC338AA91705289D611E31A93B75B830D428F25B25F15E39B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646252, "uuid": "7fa11a22-f39d-4d3a-a6e4-fedc558de4ca", "value": "1536:bw4pjQLOQ2GTZHslkJGAopJpPok9Z5ztyRd42+B:bw4pjWQAFslok92", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764646252, "uuid": "efb90f9e-feae-403c-b52c-32089bdc8311", "value": 84172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764646252, "uuid": "42d463ec-8e48-4a44-8557-a211c5c32361", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646252, "uuid": "43104ffb-0923-43d6-ac62-996e66e7bbb3", "value": "jew.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19cb416e-cf6d-11f0-a129-42010a9c0007", "comment": "Malware payload (DonutLoader)", "timestamp": 1764672793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764672793, "uuid": "e75e4a54-1c01-44a2-9546-b9378808117a", "comment": "Malware payload (DonutLoader)", "value": "7032acc8533654e1b63956d477b700de", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764672793, "uuid": "40dc8af5-c992-4ff9-aa9e-f3cbc0bcf0d2", "comment": "Malware payload (DonutLoader)", "value": "37bf86d626bd5a0d42bf35fdefc89079240303f6b54a2c57758e9a5150d11c8c", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764672793, "uuid": "1325164f-50d8-4f4f-abe0-e51d24e2590e", "comment": "Malware payload (DonutLoader)", "value": "5fa4ff7b014f32313063844dd54b3fb11016dabf", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764672793, "uuid": "196e02aa-c47a-4d32-887c-80d25cd41120", "comment": "Malware payload (DonutLoader)", "value": "bd96a53237e01ea9d222bdcd3b59080ca155dddc26e9f31062c101189dc4ed879153268ab23943d406b3d538628abae4", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764672793, "uuid": "bbfe2f53-106d-4a37-a214-e08a346b2b81", "value": "T1E9942313F6341B5E9B736CE6491CDA607AA46B5811BB8E29F4868021F7C4C2C55BFCA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764672793, "uuid": "e86b27fb-9b74-44ee-8730-d1168c0843c2", "value": "12288:WMyx1iAhPHqhxrswUjcb5wNF+gpsgNfHYRhAbx:gx1PBwUwb5wKE4M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764672793, "uuid": "a60dcebf-cc43-4e7e-8729-38ae3e80939c", "value": 433183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764672793, "uuid": "647b029f-ef1e-484e-bc82-9758a8a78c1e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764672793, "uuid": "6a5668fa-4361-430d-b341-e47d82d9b868", "value": "Details of the reconciliation.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3e4e2af-cf9f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764694581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764694581, "uuid": "6adb88dc-93fe-4e1b-89cb-fc048a04e66b", "comment": "Malware payload (Mirai)", "value": "fd46e09e839f8c729794e0b0b6d7d290", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764694581, "uuid": "1d60ab3b-942d-4680-8bd3-b75c0a295496", "comment": "Malware payload (Mirai)", "value": "37c155beb8be49f99064a94ac4c3d6b1f077fd6cf06022617747885edb3f0b77", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764694581, "uuid": "8b4870a5-7099-4dde-819a-4e867ab2f016", "comment": "Malware payload (Mirai)", "value": "36ae1cd7862ecc618d8ee2bc852fde336a501ec6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764694581, "uuid": "ecf2fc8d-036d-4a43-85db-fbe4c1200ed5", "comment": "Malware payload (Mirai)", "value": "d9129368b729934db81201f700c66816c1e3dc1503587cee3f7e6ba096578ebb462050509eb06c9d84e61218e4b74dbb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764694581, "uuid": "cf534b2f-d1da-45c9-962d-58fd6d69dbb8", "value": "T197515BCAB3D28A30EFB15D9A75F5801470C0F0996BD3DE86E0FCA4BD494EF0D5490AA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764694581, "uuid": "943cf460-74fa-43bb-9347-5d0d997de3b2", "value": "48:vXKN+KNYKNOKN0KNUpzEKN7KNgKNVKNSKNKKNYqUfKNLKN+Ka:vXKN+KNYKNOKN0KN0EKN7KNgKNVKNSKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764694581, "uuid": "6eec5f15-91c3-448f-a6ac-57a1546c3865", "value": 2835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764694581, "uuid": "4d17d807-cdbf-4102-bb5c-8f2a98d4c7ea", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764694581, "uuid": "77bdd146-0682-4783-bf0b-91be93eb7bab", "value": "pulse", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ade628f-cf50-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764660394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764660394, "uuid": "8666b2fa-e9e1-42b8-8a9f-8c1147b8bc53", "comment": "Malware payload", "value": "2c6233c8dbc560027ee1427f5413e4b1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764660394, "uuid": "d8ad3ee4-c834-4c13-b9ef-4cf2964898e7", "comment": "Malware payload", "value": "37d2a1626dc205d60f0bec8746ab256569267e4ef2f8f84dff4d9d792aa3af30", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764660394, "uuid": "a2d4bc24-0a69-47f2-9720-1d4173c85e81", "comment": "Malware payload", "value": "88b7d4b896539abd11a7ad9376ef62d6a7f42896", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764660394, "uuid": "2dcabfe1-982a-4101-9d52-5661471412ae", "comment": "Malware payload", "value": "828167804c359af50e4950c479e38a54953a4041c09658495d88ada3bf3a104c833edf2e9cb2baae5868409548c9fcad", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764660394, "uuid": "162f3971-6d90-4e7b-9b09-837d96d08ba4", "value": "T1FB837A1176A08472E5575A3838A8C6335E7F7D526BF0C0CB3F6902799F603D1AA7C36A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764660394, "uuid": "c8c69adb-d8a3-4966-b1c8-b75147ab4cce", "value": "cbfd4f16d347dbb627e3f60950c97f0a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764660394, "uuid": "3fb8a7f0-0b66-4672-a448-22dd2d489ddc", "value": "1536:6CxnF5F2kGjd5KrB5ySFjxzI/7DS/7DdL:6CxnXFod8rB59thI/y/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764660394, "uuid": "6b339e5e-1cbc-494f-a816-67e4eec6f48d", "value": 81728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764660394, "uuid": "b649a871-0138-44d4-b82a-acc66823585f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764660394, "uuid": "85b6cd45-5a71-452d-91de-71d0f2f692d3", "value": "IObitUnlocker.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53f56aef-cf29-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764643685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764643685, "uuid": "7ec90d91-6f91-4f0c-bb98-da419a2c18b0", "comment": "Malware payload", "value": "823210705b590a8ced2311f8b0106f27", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764643685, "uuid": "37091cf3-9999-4b08-8a61-827614814618", "comment": "Malware payload", "value": "381e3e28d8c2e51c141971b359604e8c0bb5cf2830f7447eee7252a8166e19f0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764643685, "uuid": "68dcc4d2-7182-4b6c-a58e-c250533a9bb4", "comment": "Malware payload", "value": "e7ab14fbe64ba1c8bb0778b5f24707faa3fac2b2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764643685, "uuid": "c597c4ac-b1f5-4c02-9adf-11d3802052e3", "comment": "Malware payload", "value": "61dd593d13d5de34c8238cbe5e3ead51f1bdeed819292b58a5472e3e9cc89169b27636a1632fb02a09c6b5d0ff7ca45e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764643685, "uuid": "b067b01e-5d00-4231-954b-e2ed3ef7b4c9", "value": "T1B2E68D1019799D64CABB1D3249BFF339B77367188215C96F0D7499A0FCD2393EA0A287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764643685, "uuid": "9101616f-472d-4c6b-ac84-013d8e8b64c0", "value": "35d5a336654859f7c7b6af3931f10d6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764643685, "uuid": "458a5660-a6f2-40f4-99ff-ede5d2018aba", "value": "98304:mMn3gxchCe+gpLP0w+nXWHxV7946hJSBBlZUOv6SWBjmLHq+iFmXonw6mnp4/oAC:T3xiW01G779KBBlZUCrnpkEq5zwE2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764643685, "uuid": "ae91b7af-87bd-4a98-aa31-17ef95b1134d", "value": 14682626, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764643685, "uuid": "777b3bba-067a-463a-abc1-52482b2ce892", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764643685, "uuid": "10706fbe-8a65-42e8-b211-5eb38dd06682", "value": "secondstage.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b652380-cf94-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764689573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689573, "uuid": "6e52175b-6a87-48ad-92d8-1514bd474cdc", "comment": "Malware payload (Mirai)", "value": "4dfcfa414a9bbd9f457d6c4f39dc4d11", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689573, "uuid": "638acd84-ae46-479b-bc42-33a555fc1235", "comment": "Malware payload (Mirai)", "value": "38cb0dc21b8da925e1fcd145257708a5f06b61842bb0677a30f116b021f4da3c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689573, "uuid": "5755624e-aef3-46b2-bd00-8dbfc202ac3e", "comment": "Malware payload (Mirai)", "value": "26b51017e935ab9773397bd94d134e05be8b38b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689573, "uuid": "6e2106aa-f7c6-46a2-a556-99f6ae5abaa2", "comment": "Malware payload (Mirai)", "value": "da05b3f73b9d576de6a5599bbeb6945c278c9bbce0fb423106792b38d934d361e5a8d7c688335809828ebd15241b036e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689573, "uuid": "a72b28d5-2a78-4bb4-bc43-ef789bf5516d", "value": "T18D341B46F8819F21D5C016BAFA1E118E332317B8E1DE72529D245FB47BCB86B0E37A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689573, "uuid": "0b05ab1e-9190-4dd9-a92a-483f4ad80b74", "value": "6144:AiW9LKdUNq8v3RyDYx1PX+CFwaFFkQTYmm0Gf10:zW9+dUNfv3gDYjPXPwaF2xmmE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764689573, "uuid": "03e5b19e-51a8-4eca-b62a-1b53249c747c", "value": 250204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764689573, "uuid": "ab14efbd-f170-400b-99c9-36bec6e530fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689573, "uuid": "aeaf7777-1953-4670-81ba-13d0da6bc46f", "value": "ecco.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19091c0f-cf49-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764657330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657330, "uuid": "ba7fb159-a95a-4edf-8878-789d17b6c0dd", "comment": "Malware payload (Mirai)", "value": "f383b6276e2edcad22c4fb9a250146b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657330, "uuid": "b365f6a0-a982-47ad-8540-cbdd3275f8c6", "comment": "Malware payload (Mirai)", "value": "3925f06a90e2ef805fd0eeef93a484cf615836b444ab8959759eae314c8f9465", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657330, "uuid": "e9d30ce2-c1ab-44eb-b970-ab4a3dc34472", "comment": "Malware payload (Mirai)", "value": "d233eca93a3dd01927f387993edcf6422d00b206", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657330, "uuid": "5ed9717d-a594-41ff-9ca1-dba22d90de16", "comment": "Malware payload (Mirai)", "value": "f02cc23505facea3ea50a4da75780caf4c9066a6953bb2e0c1b41929d5743a54ec984d29ba63a041530c4a06a0882d58", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657330, "uuid": "5559b5a7-bb67-4b0e-823e-7d333fc11405", "value": "T151A31956FC829B02C5D512BAFE1E118E331327BCE2DE7213DD24AF21378B55B0A7A516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657330, "uuid": "e907d590-a2ce-43ad-8f39-4bce79f4be8c", "value": "3072:T/Puzi8g0sftySY09cc3TbT2yawe4ug4dyB+:TPuzin0sftySY09cc3PTRa/Vv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764657330, "uuid": "fba87cee-814f-4c94-97e3-785bc126a1fc", "value": 103976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764657330, "uuid": "00fdbd5f-092c-431a-842a-c696a7be340b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657330, "uuid": "303b14e0-b5f1-48ee-a08a-689aa8a149e9", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "835771fb-cf99-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764691868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764691868, "uuid": "1a112908-1a62-4af7-86c5-93bd9902c8f4", "comment": "Malware payload (Mirai)", "value": "5a8dba8274d344f45186d05b43acfb03", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764691868, "uuid": "b5404b86-7900-48ae-9e72-e23c8ecbda0b", "comment": "Malware payload (Mirai)", "value": "39535171050a7baf5dbcc244c44452bda9096d816c8ce88c5d1187b33b7d6053", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764691868, "uuid": "c715ad39-512a-44ff-8a91-7297655241bb", "comment": "Malware payload (Mirai)", "value": "c842c4803a6d560595eec55e8317401ea4e1c8c7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764691868, "uuid": "e91252e4-cbd8-4ae0-b1c7-cd7fb784df87", "comment": "Malware payload (Mirai)", "value": "7a0c2af029fcfebe464ded88627ba0c02eb525518d78e767bd594ffc6c72e05f1114a0ea900ebc9a07ebd8879c01ffee", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764691868, "uuid": "d3794fe5-900f-44d1-9957-2aa9dca8d2e0", "value": "T106519DCAB3D64A30FFB15DDA75F580147080E1996BC3CE96E0FCA4BC094EF0A5490BA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764691868, "uuid": "5659eaf5-6458-4c25-a718-d57e6d3857a9", "value": "48:vXS+SYSOS0SUpzES7SgSVSSSKSYqUfSLS+l:vXS+SYSOS0S0ES7SgSVSSSKSYqUfSLSu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764691868, "uuid": "a0a40f35-03a5-4184-84a4-e21911dde2b4", "value": 2821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764691868, "uuid": "cd9a5e34-b9ac-410f-bde0-c80c18bed9b4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764691868, "uuid": "63818a6b-cba2-4b7a-9ed5-a5b270b94447", "value": "jaws", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "822d526e-cf5b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764665238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665238, "uuid": "04cce7c2-4d35-416a-8a1c-319a16af0147", "comment": "Malware payload", "value": "7d081e3c1a051369fd582f0177817286", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665238, "uuid": "e1b3bb52-4980-47e8-b709-f4b11733e0b2", "comment": "Malware payload", "value": "39a187dac355862ef1ac32c84e199b2aa0b4f8831cbe05c14601853bf19466be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665238, "uuid": "4fce7029-688a-4ca4-8a2b-641d90e72a15", "comment": "Malware payload", "value": "9fa12bf0a9179f3c68a8362fbe537ee970affcfd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665238, "uuid": "14d85b80-039d-43ef-b1bc-8617b8b42985", "comment": "Malware payload", "value": "127ece19f643c9a46c501e88c02bb902d5c42f903ccadffacf34beb3cd92799cf9527315460042d6b1c13165ae0f58eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665238, "uuid": "18a93f48-95e3-4715-bde5-49fef41d9f58", "value": "T1B364836AEA10B426F987243439A8E59778293C737A41EC1BF7815BA7347268771F070F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665238, "uuid": "309afcfc-764a-4c01-b4bb-1169b766faa2", "value": "07caa8ae7ddecf84928435b899c5c283", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665238, "uuid": "1818802e-4dc4-4e9c-a008-30ae1762442c", "value": "6144:wTfqX2gtbyXFEs65yGgxaUqhCOTweCOXNC2neyUtALu:ZXGJOXNC2neJtv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764665238, "uuid": "1857a67b-4e0c-48b8-898e-e3bfd61f940c", "value": 311371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764665238, "uuid": "ad64b928-65bf-4166-90c8-519bd9af9479", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665238, "uuid": "fb5e7171-401a-4fd9-9846-f7cc990d2b01", "value": "fireguard.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "882d6198-cf45-11f0-a129-42010a9c0007", "comment": "Malware payload (ACRStealer)", "timestamp": 1764655799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764655799, "uuid": "4882f788-1878-4700-b2a2-d2aaa03ee6b9", "comment": "Malware payload (ACRStealer)", "value": "796a4ba3254887981f8661c3e8c7832e", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764655799, "uuid": "9b44ca4f-53e0-404f-a9ce-78165a1104a4", "comment": "Malware payload (ACRStealer)", "value": "39c294390009834552aae2fbcae03fe3cf9f4fe5eda668c224448a0f4679c0c0", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764655799, "uuid": "ba9c1f6c-b88e-414b-abd5-b02a9657381b", "comment": "Malware payload (ACRStealer)", "value": "2ca4c29daf94d5fc9f92479b9cb3f8ca0881fc7b", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764655799, "uuid": "7878a4ae-6121-49d0-a63c-356691f10325", "comment": "Malware payload (ACRStealer)", "value": "bb253bdf4d3058be83b0af467e60c8eaaef7638604ef0bf2135dd338b6e384f5451d9646c9076c8d925b14003a0691c7", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764655799, "uuid": "b8f2f18a-38be-42bc-91b1-8c0dd98630fc", "value": "T15B352342AAD984B3DE3013F018FE428707367C758AB8972B3785684A2DB36C57936777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764655799, "uuid": "0d9d0897-d727-4111-a799-fbf58ac95df1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764655799, "uuid": "ff937441-b427-48c4-b808-48106eeab88e", "value": "24576:ny5bm/WXaS5S7O/v94aiFJK8bdW/KrYSCinNtS+j2F+:ytm+v5NX8FJeeYSlNtfW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764655799, "uuid": "0a2a3ed5-6a09-48ef-a4d2-12f5039a435a", "value": 1138688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764655799, "uuid": "248dabfe-01f4-4f78-97a0-defe18ca8682", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764655799, "uuid": "b1914187-9c3f-4bc5-813a-83fcacf0bf28", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fa26ca2-cf58-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764663972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764663972, "uuid": "2b769f13-1256-480e-a58f-cd7c0951d65e", "comment": "Malware payload", "value": "00ec6f76efcf850ca5f8956d36f1fdab", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764663972, "uuid": "8c3ef90f-b244-4e8f-b7c5-9e7d5a9997ca", "comment": "Malware payload", "value": "39ff96df1f5894bc094b1efca76a8418d264022f049ad473a3adffcaa3ceb84e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764663972, "uuid": "c290f9fd-e48e-4eb0-a879-ba91a8452f5a", "comment": "Malware payload", "value": "8e7a77e916409fbb64e67b8c51281ed0656c8f96", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764663972, "uuid": "e98ee01b-71e1-4a4d-ab1d-4f077659f9eb", "comment": "Malware payload", "value": "01474d6d58e16e1fc16f489d50e3e080410e453a073a459f35e7a18a8950f9a98dcd68aead1beecfb7f561a0a0d27749", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764663972, "uuid": "e21ffe4d-78ea-4b03-8f5c-328ed5d4309b", "value": "T17D6602D6FBE89E2FC8775032C56A52F1524B4D128A839F476904371C787B6E80F4ABC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764663972, "uuid": "8755c35d-efbb-4b0b-8286-c810e08e17fb", "value": "98304:ohESwm3ROFeWWwBtniWWUT95yjck/SANa6oXMXVkMNdFeYOZnJrV774GRLY+30VG:o2yBOFTFJWDjN/dsX4dFh6n9Yk0Hs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764663972, "uuid": "a51b97af-4fd8-445e-bd1f-6dbfc6391258", "value": 7029009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764663972, "uuid": "a8289e8c-bf17-4cee-91e9-620bdad6c38c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764663972, "uuid": "5493863d-5057-45fa-a908-e32b5e1f6658", "value": "app-release (4).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9e060ed-cf38-11f0-a129-42010a9c0007", "comment": "Malware payload (Loki)", "timestamp": 1764650406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764650406, "uuid": "30ec4ce1-a5a7-49b7-9281-7277aed64681", "comment": "Malware payload (Loki)", "value": "97673584c7a9d83366baff1628287abc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764650406, "uuid": "4d6e988a-dfc6-4d20-a712-12972729fc5e", "comment": "Malware payload (Loki)", "value": "3a3b86845990070fa63fed00a32530b49765b5474e70e29b29889715eda8e23c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764650406, "uuid": "bc730970-cdf4-42f1-8352-a96f48298993", "comment": "Malware payload (Loki)", "value": "0ce088f4d71d7c056b47594cc99e931e489a3aa1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764650406, "uuid": "addea87e-8c53-4ca2-ba68-309850b8056b", "comment": "Malware payload (Loki)", "value": "62912dd61615b5dc135e18abecb60a5cf3bcbb8ef88c0764a025896a215a2d644f70fadeebf83a3f10291827794f94cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764650406, "uuid": "491fe30e-baeb-4e08-a1aa-2edd9385b9b3", "value": "T156A32942B2A5C030F7B74DB2BB73A5B7857E7C332D22C84E9352459A14215E1EB7AB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764650406, "uuid": "7abd5d59-e903-4cb7-afea-b1a110b71cb2", "value": "0239fd611af3d0e9b0c46c5837c80e09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764650406, "uuid": "6b24943a-d18f-47fe-94fd-3df81421cdfd", "value": "1536:6zvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EquIzmd:hSHIG6mQwGmfOQd8YhY0/EjUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764650406, "uuid": "95010701-0da5-483e-abb4-99544ba1122f", "value": 98816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764650406, "uuid": "27e7dc45-fb23-43c5-a2f1-719952aed79a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764650406, "uuid": "ae718689-06f2-4059-9079-e49da1cf8c56", "value": "97673584C7A9D83366BAFF1628287ABC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "382b38ce-cf5b-11f0-a129-42010a9c0007", "comment": "Malware payload (a310Logger)", "timestamp": 1764665113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665113, "uuid": "578e7de1-e95c-4013-97fc-05817b066076", "comment": "Malware payload (a310Logger)", "value": "fddc330d87a43a8d0a8de9f108360ca2", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665113, "uuid": "b91a2c59-8338-4082-8c09-49f514483d40", "comment": "Malware payload (a310Logger)", "value": "3b504d803733fab4f75705dff7b109b2732e68d53fd4e510a9b863329452f4a8", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665113, "uuid": "65f83841-cbd6-4eaa-931c-143b507edbbf", "comment": "Malware payload (a310Logger)", "value": "d521c035ee403a4248b0d0d455281a6a998b92d6", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665113, "uuid": "22278892-1d7b-4fea-8c4f-9ba57cb26bd2", "comment": "Malware payload (a310Logger)", "value": "512c1c4ea92f50229212bde4de5e3d4041e882a9045fba6887ab3519064d77c44390640cc099e4fd9f1a626d408c88f0", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665113, "uuid": "3a84b731-cba1-439b-9af7-61c66a443a9f", "value": "T1B255CF027391C062FFAB96334B5AF6115BBC79260123EA2F13981D79BD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665113, "uuid": "898f8d63-f457-4918-8956-880589d5481d", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665113, "uuid": "786ca861-ef0b-4a73-b398-b408de4b0f45", "value": "24576:z5EmXFtKaL4/oFe5T9yyXYfP1ijXdaGqal7PHXIJOKJJZD2:zPVt/LZeJbInQRaGq67AJZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764665113, "uuid": "7953f8e8-23a7-4686-a5f3-2f19a78d44de", "value": 1332736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764665113, "uuid": "c3850a9a-2093-44a1-b194-164ff2c4a8bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665113, "uuid": "f5e6c6e7-6243-4b1b-8f84-12ae8ed74d37", "value": "proforma Invoice Sheet.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ef93c23-cf5b-11f0-a129-42010a9c0007", "comment": "Malware payload (RedLineStealer)", "timestamp": 1764665259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665259, "uuid": "60b7edb6-a9b0-4edd-91b1-d4b65952a5e2", "comment": "Malware payload (RedLineStealer)", "value": "752a4e3410a695967be0a71fe920def6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665259, "uuid": "0296826d-a910-4046-b0fa-e174d123045b", "comment": "Malware payload (RedLineStealer)", "value": "3b54db03bae9ce2753459bb8e6951f9aff5c87a0a505c08b288f30e8cc9bf97e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665259, "uuid": "886c6d3c-49ad-4258-bad4-4af591dbd133", "comment": "Malware payload (RedLineStealer)", "value": "a3e1b9f8c2d36f3f543814545365242b8093d7ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665259, "uuid": "dd8f5eaf-6655-4dd0-bbab-6d11ff9a7617", "comment": "Malware payload (RedLineStealer)", "value": "ee633812490341ef59a0a468734bd1249f0fc12375df1eab645cf489835a3438fcd8a80dc752980e2c8321954f3103f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665259, "uuid": "e3f17518-300a-4c29-9042-dacad82b3fc6", "value": "T19075D00273D1C062FFAB92334B5AF6114BBD79260123A62F13981D79BE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665259, "uuid": "1b75313b-e3f6-4e04-8fc6-7e557e04cbad", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665259, "uuid": "7ac437b5-d142-466b-89ca-59fb413dd0b5", "value": "49152:cPVt/LZeJbInQRa2CRzMSnmF1m8TyyGCZ3:iTYbInQ4zBnmDlyyP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764665259, "uuid": "eddef5c9-9e57-43b4-b674-f6b410161fdb", "value": 1684992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764665259, "uuid": "ce6bd692-82aa-4a05-a68b-794f30959b6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665259, "uuid": "484334ed-c4f5-4de8-b19c-a76d7009a918", "value": "listado facturas nov 2025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a193ece-cf35-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764648903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764648903, "uuid": "68ef96c5-c28b-451a-a66b-6117b1dbc6bf", "comment": "Malware payload (Mirai)", "value": "33eda8b7c079ee1e0bbaaff8a84a5905", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764648903, "uuid": "c360759b-b051-4d0b-8830-b9a8dd4210b2", "comment": "Malware payload (Mirai)", "value": "3e6fcb86efdc434fa9a1d16b3f2394df69b4472b5523c8603741900a38436b53", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764648903, "uuid": "1b797ebe-256c-42ff-8c9a-e2f71be694a3", "comment": "Malware payload (Mirai)", "value": "59f3ae22f28ec4154cd50aa7c985b98960c3f1f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764648903, "uuid": "790d52ec-517a-449a-9cc5-b44d9e21f0e7", "comment": "Malware payload (Mirai)", "value": "eb6473b8abd146c2df8d2b2a51fd6b524360390a3abf75a094dfe8ed3ded509bee2a639e822a4d4f075b004017b40559", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764648903, "uuid": "c07b59f8-7cdd-4cdd-8e43-383cd9bbab0c", "value": "T1A4D3BE31F01A6CA4DD0106B974B6957C0700EFB406E61183EEBEE5AE18BBE45BDED670", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764648903, "uuid": "184cef40-ed2f-4c0d-92bb-6612555b5600", "value": "3072:0QqhCmbObRuDVeZHxPsMtdGZwXVevRIziZ5:0QqhvbONu45xPtcOEvROI5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764648903, "uuid": "52789730-55b0-404c-8112-bbe84572da14", "value": 131700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764648903, "uuid": "c7889384-d231-4410-b6f0-dc461bb49be5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764648903, "uuid": "bd2d470d-f8dd-4422-8b37-97cfab038576", "value": "xnxnxnxnxnxnxnxnsh4xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b08318be-cfa3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764696239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696239, "uuid": "c7d9ad98-7c97-4939-97e3-85ab4f35d70d", "comment": "Malware payload (Mirai)", "value": "4f1fbd53fcc53f26fc90a1d24cd4c09d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696239, "uuid": "2b244d7d-789f-4ec6-b659-dbf0540b2462", "comment": "Malware payload (Mirai)", "value": "40af1925155706182ec2018796144f27643810d8781097be356cd62dc177c889", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696239, "uuid": "5366381d-c3f8-4d09-94a6-1bc1bba3a753", "comment": "Malware payload (Mirai)", "value": "c71b1d632f1b2517786b4667727e12246637fbc0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696239, "uuid": "17821437-99cf-4a22-8132-dbe5f48e7f7f", "comment": "Malware payload (Mirai)", "value": "fea1fb3364369d7ca9db52c18e6dbf782afa7988676d09639414860c7afb81e2383b29757f66bcb68008e60fac5db040", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696239, "uuid": "f8a96e22-c24e-482e-a258-aa1c1ba83c69", "value": "T171935BC5FA43E0F6E85705B65037BB328732E539502ADA42D7A9ED32EC52A01D61B39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696239, "uuid": "a636ea50-71a0-4a1f-93ff-89c84a4e2c29", "value": "1536:e+kBWnrR3hBjPQ4A/F4Dco41nCHnqIuuCK6SlZ38/Mm:exWnFxBjI4c0coqnCHqIFTPkMm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764696239, "uuid": "e156e237-0031-46ae-97d1-87ee9873a3d6", "value": 96588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764696239, "uuid": "442d0421-d46d-4360-bf06-523d923d23ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696239, "uuid": "b2864255-85fb-4c60-86ee-b36be71717a7", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "191dcec5-cf4a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764657760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657760, "uuid": "b4658170-83e3-4c9a-b0db-ec623e6f5953", "comment": "Malware payload (Mirai)", "value": "befc54b38c2dad8667c44304d80e55b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657760, "uuid": "2dc256ce-48ed-4221-a8ce-3fc17c828827", "comment": "Malware payload (Mirai)", "value": "410d640f3a1ef76e7ed31d6fc49f72689854f47d175b8bf7635296eccbab9f15", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657760, "uuid": "20c742e4-b850-4215-8f64-5c20650dfbac", "comment": "Malware payload (Mirai)", "value": "f965c50ab27138b763a14a789ee6588b031f1a06", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657760, "uuid": "7241f744-e029-4aa6-9b54-d4ee7f3fcb08", "comment": "Malware payload (Mirai)", "value": "f1db4c7ebcfe8daf1e1ea4446f70273e1dcc0f6fbcb5f90812c7d5d8db06814de6fe7eaba2d731a90e850f5ca4bd4a65", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657760, "uuid": "5a9c51e6-c718-4771-b5b1-fcaab6f34031", "value": "T14673952BBB61DE77DC4ECD7306AA4502208DA44A12D96F2FB6A4D51CF34BD4E48E3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657760, "uuid": "c61b89d3-7a0f-46e6-b116-ccaf1f08f35c", "value": "1536:3eTB+JZkXDwhToPVoFNsQ9qZuLM8tUHHnB:dJZkXDwuPzsqQUnB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764657760, "uuid": "a43f7aa2-e92a-4bdb-a217-d26c84827d6d", "value": 79644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764657760, "uuid": "e5ce42ff-f34e-4e15-8218-d3ea7adaead2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657760, "uuid": "cd321185-694b-4852-8951-f5e7f196e356", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "867fc82f-cf38-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764650213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764650213, "uuid": "6f8f0261-1ffe-4b91-a35d-06ad4dca8197", "comment": "Malware payload (Mirai)", "value": "f4304d6584eeaa165f40c9f77f880a55", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764650213, "uuid": "d6aa3b92-a618-4264-bc3c-8979a93c37ab", "comment": "Malware payload (Mirai)", "value": "427ef99eeebb588d8d163bbed8db54a82d27d1036df53e957318aa8dd0e68576", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764650213, "uuid": "24dc4323-0729-41f1-9b99-4282e25be86a", "comment": "Malware payload (Mirai)", "value": "e387a65dc35420163094c7de3c87e7d21de547f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764650213, "uuid": "6038f637-4e81-4007-94ff-f834c35db5bf", "comment": "Malware payload (Mirai)", "value": "bc211147fe9124c54da0ecb2909703a5b59997b19d806cdbce560fae5167743d68e908b30550a4c6eb8cdfbf2878a475", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764650213, "uuid": "7960ff32-ffab-4343-9e16-cf1bc3852b2c", "value": "T140A3B087A560BEBEF0656D3F84134F65FA14CF601A832B25A17DF590767E38072A7E02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764650213, "uuid": "13a657ec-5282-428e-ab07-1f8147d89625", "value": "1536:99tTpuo9SovQRwAf8nbkXGaaqHSHLaGaUQhHvnOda/ViV4cB8rSY:ftFTAfWbkLO4UQuadGUSY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764650213, "uuid": "95579723-8282-41ee-aeed-3d6bb14def63", "value": 106968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764650213, "uuid": "356dea66-c446-4473-8e26-da048bd6f348", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764650213, "uuid": "aaecd7e3-9895-4b38-89b2-ebf0ed0effb2", "value": "xnxnxnxnxnxnxnxnm68kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e043c02f-cf42-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764654658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764654658, "uuid": "7a79574b-c874-4767-b9e0-3064f02347d8", "comment": "Malware payload (Mirai)", "value": "796db82ccf7425920457d29facfe700b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764654658, "uuid": "08f05030-3bea-4398-804d-bb2c36cb50fe", "comment": "Malware payload (Mirai)", "value": "42b1504b7e67c4f3831836ef5b5b7fb5d4193fc904e3ca0b3441749afe929dd5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764654658, "uuid": "b3ac352d-6409-4c2c-bf80-de7d7ee7586f", "comment": "Malware payload (Mirai)", "value": "17212f8e8a35c36ca7a629e6775c8fbb034c593b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764654658, "uuid": "a7dd448a-3027-47ef-932d-65a818ca8708", "comment": "Malware payload (Mirai)", "value": "ca6c8e1f897ece8e2f16886b0afe5174f00281c8b92865871e959ddb7774fc2ac9f731ab8e379fb1cf40275360ee1cc9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764654658, "uuid": "56adba92-c4cb-4030-b066-cd5a8acde77d", "value": "T1EC4194DA315544B12EE6DA73B3B9049471C5A28594F0EF6F5CEC79F4488CD04BB84E43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764654658, "uuid": "47c56f5f-0bed-41ba-8bce-6f12509e7858", "value": "24:vASlyd/sABU/sAY8/sA/eld/sAK51M/sAa9G/sA3A/sAE58HZ/sABk/sADqh/sAY:v6GaftGd77RAyHKimPdd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764654658, "uuid": "90c28e43-4811-4be6-b13a-a2fad3d309c3", "value": 1976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764654658, "uuid": "3f0800b6-31da-4332-9be5-d0a99e93e936", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764654658, "uuid": "322b5a43-3343-4b15-b180-3254c6dff3a0", "value": "jack5tr.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7a18354-cfa3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764696251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696251, "uuid": "fbb04279-ed35-4aa2-949b-fcf4181f6911", "comment": "Malware payload (Mirai)", "value": "b73652e41dc212745f13e4f3c5f5c2bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696251, "uuid": "e7e5d4ff-d543-468c-9212-81ff458dd0ad", "comment": "Malware payload (Mirai)", "value": "4448305310bf4d40d9f946c49a63dd54fc5bb7347d6bee935df6021df54fe3ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696251, "uuid": "2ac25648-11fd-4f00-a4a2-00ed079fad32", "comment": "Malware payload (Mirai)", "value": "821d5c189080f18ed10ba1fb5b3e9944fa17c08a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696251, "uuid": "b4f6079f-6d55-483a-af5c-1288518f33a5", "comment": "Malware payload (Mirai)", "value": "ab86eb69971d4705ea2546e2a1e92cca87c51bd7597eba968f47eb7680575429f9e33f45de1f454a9f8f260512612e4f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696251, "uuid": "074ed12a-4ff5-42bf-b6ef-8815851c1bb3", "value": "T101D31A45F9504F23CAD512BBFB5E428D772617A8D2EE72039D256F24378B86B0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696251, "uuid": "cd2f3f5a-82e0-4c92-83c0-1b22845b19b4", "value": "1536:KzJXBKOxpsfYnPZ5YfLPKqD2pz94VI0FlTpE6h66tfP3iddBlGFwywW1wu4iKrVT:KztBAf0YLCqDq4NP1E6h6sHSdMvK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764696251, "uuid": "b25322ea-3038-43a4-aa86-f130540052da", "value": 141920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764696251, "uuid": "44db3ef4-c26c-412d-836a-98112d31457a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696251, "uuid": "eae90acd-062c-451d-9534-17953dafe985", "value": "nshkarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dd93e5c-cf4a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764657956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657956, "uuid": "aa20ed36-dcfd-4152-a356-e3a4c8aec1c3", "comment": "Malware payload (Mirai)", "value": "df5c60f0d2ce6005646ccc13a796493a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657956, "uuid": "410bde65-3046-4a57-92bc-66c0fc7323e2", "comment": "Malware payload (Mirai)", "value": "4587f1f4c443136ccfaa5b43de1f66db4eca97df097c53679810ca56213b50cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657956, "uuid": "5b836649-409a-4ac9-9690-8445ea763e9c", "comment": "Malware payload (Mirai)", "value": "a9dcc493d499c5d75e7ac370a289bc0f010c22ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657956, "uuid": "a0255a4a-f536-4c98-b06a-2c4d82a20f10", "comment": "Malware payload (Mirai)", "value": "52953c5d3822cf321159b8e3330d5227cd7e321182609810bd75dad00a50fd229a7141f500297c8a1867f50534494249", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657956, "uuid": "4255bacf-2098-4479-a60a-e228b8784e92", "value": "T19F631225330546B1CFC60EF3B9A6A6921EC50F8378C1B29A0EF473B93D7B28917E5042", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657956, "uuid": "7c92ef2b-9ba5-47cc-a856-8ff04ba85845", "value": "1536:lQwJ5k3eAYOYSVBghTlYGvhXzYkmwYbFFDNeTQor9:R5kBLV2TlnhX8fwIB7S9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764657956, "uuid": "57658ded-9095-4395-8b88-f933719ba9c2", "value": 72820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764657956, "uuid": "492a9599-7c02-496f-969e-3ec08df778e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657956, "uuid": "02daca17-bf92-4ce6-8fbc-84f33df2ed64", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3001377-cf46-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764656381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764656381, "uuid": "1a1a66b0-2abe-4cc5-90fe-61cea6a98821", "comment": "Malware payload (Mirai)", "value": "dc5e9a86f1e3cd8cdc8f310bd3ed6174", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764656381, "uuid": "671a918f-6f8e-48f1-a705-517519f31191", "comment": "Malware payload (Mirai)", "value": "45c7c5e179924a4eebbe4454d151122bb6652efafee5aa41613704c5a9066c18", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764656381, "uuid": "e0bfc698-7e67-4529-9818-970a784bfc89", "comment": "Malware payload (Mirai)", "value": "14ef0c350befdf11837a4e6b92ab4c1cd4445ed7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764656381, "uuid": "ac09d950-ebbe-435b-90af-3f012bcaa231", "comment": "Malware payload (Mirai)", "value": "6e5c71e4677be484d5bbca080514ada0301b9f929f2b0f6c20006516a79118d220af8df5edeb37af4274ef9eae14c00c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764656381, "uuid": "86f625a1-b3c8-41e2-b978-a66d2d330eb3", "value": "T12D432A96B801AD7CF94FE6BE94234D0DFA21335051930B2B67A7FDD36D321A86E12D42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764656381, "uuid": "ecfbaba8-1675-42c7-92d7-3626a75d2da0", "value": "1536:oFMAMFlwZA9UwTrPE3wqyIE8WhibBqKpnzy:zTFlwZSUwTYlfqjKpzy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764656381, "uuid": "15191825-9ef3-4250-a7e4-e21d30a74b8a", "value": 57088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764656381, "uuid": "294c62eb-382b-4998-84d9-f5217fdf26ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764656381, "uuid": "869ad9b2-d5a0-4971-80a1-c29000c57b40", "value": "jew.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a957775-cf90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764687988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764687988, "uuid": "ccf6db6d-c7c0-48e2-b833-faf8b31c6dc7", "comment": "Malware payload (Mirai)", "value": "d0e577bfa998fd4ced0ddc198473287e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764687988, "uuid": "66c69a9f-1710-4b5d-a148-7b896e0b826d", "comment": "Malware payload (Mirai)", "value": "466b9e93c1741841f1cd5543e6d11ecb97e828431da8e13d58609a7e413a3f46", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764687988, "uuid": "50bea401-a465-44e1-b273-d458e0aaa8c1", "comment": "Malware payload (Mirai)", "value": "d58bf0c5e6fd654f747d2a2b9d416ad82aaa9e64", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764687988, "uuid": "5ae32079-7ae5-4f2c-83d6-d7930330318f", "comment": "Malware payload (Mirai)", "value": "ac6007de81e98d1b032d9025c31458804adbc46cda0abf0c05e026a69f695e3e5ff931526ae47b35645f77bb4c1ffad5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764687988, "uuid": "69b2ab46-7591-48c7-a7ee-cd05e910abc6", "value": "T17651E7C543880C70AC67EB33E7B6417C33C591D798E26BE5D9CABAE90A5ED143540B93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764687988, "uuid": "2645f7ac-722a-47d0-acec-98d7ee953ad4", "value": "48:vh7u7N7hhP6GhgHzPh/KWhloUh7l7o7Uhfw3bh+9RhZcghqpVhHSOhz+ChAfThYu:vh7u7N7hhP6GhgHzPh/KWhloUh7l7o7A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764687988, "uuid": "890c1dcb-5149-4cbf-b532-41f3453db572", "value": 2910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764687988, "uuid": "37209d1e-b8bc-4a4f-8f98-cad05e2a2c79", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764687988, "uuid": "918d7489-7d3e-4ea0-900b-b6422201aa3e", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7245c931-cf3c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764651897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764651897, "uuid": "073a0700-8469-4d93-8495-e9228c4d0095", "comment": "Malware payload (Mirai)", "value": "2da8cfc4123509ae055c17f0dc66dd0e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764651897, "uuid": "d4410a2f-3312-478b-b1bb-68e8870794a7", "comment": "Malware payload (Mirai)", "value": "46a4788bc2c5a55a17a8b4959350434e651251aa52977f02baf1d0041da2a0c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764651897, "uuid": "02b88e06-56f8-45ea-b7de-bede2a63c25e", "comment": "Malware payload (Mirai)", "value": "93fa8796567f1d20ef6ea5f42425ac51d9fe615f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764651897, "uuid": "48b50082-dcbe-46d7-9778-5b16341a302c", "comment": "Malware payload (Mirai)", "value": "02fc3aeb7a0a42f98552df68be23558f939e54aab05aa45f051edd16f732c1d3713586801ab4f5af84e8c4467015415d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764651897, "uuid": "aa4bceaa-2cad-4bf3-878a-5cdfe9a70fba", "value": "T17D059E99E783D4E0F16340F1024ECBF21934A12A6093FAF6FB852A577432B916F5636D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764651897, "uuid": "91054fe1-b118-447d-b98c-18e90c9ed6a7", "value": "24576:1S0uyiJCKCiEhfuhaKcsi/tnQG98klgKSW:g2K8hfuhakIBtl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764651897, "uuid": "71261ad8-0d18-4158-b402-6e2d7d487fbe", "value": 850644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764651897, "uuid": "fba2622a-aeca-460f-9450-e6c75321f2c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764651897, "uuid": "2a1049b3-78bb-485b-a0a2-de2932869b3f", "value": "sync.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ee6cde0-cf16-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764635436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764635436, "uuid": "6ba213b5-9905-4f30-8bfd-cb9148379728", "comment": "Malware payload (Mirai)", "value": "707c65b3a03903a5587601f08e449841", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764635436, "uuid": "5424a0f6-1435-48ef-8505-2d6a58bc2696", "comment": "Malware payload (Mirai)", "value": "470cc20559bed759931e88a100cd8281b8cbdbcbb431865e1d3795cb933e2625", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764635436, "uuid": "6dbb4f2b-8182-4de9-a9de-8c96c61acbfa", "comment": "Malware payload (Mirai)", "value": "d9659ae150b3554002a56b34d10062531b1caf76", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764635436, "uuid": "24a6dd90-6bd6-4b75-80dd-2093ddcbd238", "comment": "Malware payload (Mirai)", "value": "1f02993fbd0cbf6da04426b651bbfbf96ae58bfd0ce344dc46e09766eede75d30733a553b60d0133170999a58f9a1fbc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764635436, "uuid": "99e2b490-50dd-4fd1-99f9-907f41f9a797", "value": "T17AB32B07F992CA12D5C712BAFB5E514D33136BB8E3EE3212CD24AF6033865DB0DA6552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764635436, "uuid": "075ec562-a768-498b-9acb-6af8ad1bd008", "value": "3072:j321QXOiikG2a/7//6kWdmd5s/23jCPP:j3Z+iikVaDCDmdu23jCPP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764635436, "uuid": "ec450c7b-816f-4e95-8324-2570d91b4ba4", "value": 111504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764635436, "uuid": "8d01bcad-70f8-4b73-ba47-4257d92c11c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764635436, "uuid": "3bd69337-573d-4dfd-8333-eed6edd375fc", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45a9df5f-cf97-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764690906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764690906, "uuid": "7d8468cb-c919-4a7e-b1ad-4b673818a6d0", "comment": "Malware payload (Mirai)", "value": "9684a48c60096b20d2c01010fd9f58f5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764690906, "uuid": "ab69d463-4124-4cd1-9c8b-850ee9cded9e", "comment": "Malware payload (Mirai)", "value": "478a079faeecad0d70309471f496de500e2eb20fc6ec38321e159a90873011ba", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764690906, "uuid": "f4750e7f-e7bb-4379-a973-2f049f4af95e", "comment": "Malware payload (Mirai)", "value": "1890ec6cb42214e17087ae55d705f35eb21df01d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764690906, "uuid": "10adca66-847f-4675-9b0e-54e88cd790f1", "comment": "Malware payload (Mirai)", "value": "49f8494bc567697d2c85805825c107f34bd1d69dfb490878671b64d7f798b32e5cf9be98e43620e31c1a90ad49556d13", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764690906, "uuid": "20fa7022-1eae-41de-882d-7455f23fc1e5", "value": "T12161D7D511424B706DDB7C12E368C77D3441A9A7C8EBCF1667EC28AA2C4DEC8AC5D742", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764690906, "uuid": "6115ed86-d7e7-43cb-9a8e-0b254c4cd882", "value": "96:i1Cq19M1s61VU1z81bQ1wK1uC1DWL16W1hZe1Nc1Ii18y1J/H:h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764690906, "uuid": "f7926fef-4361-463c-8439-bc301d43b20f", "value": 3269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764690906, "uuid": "216abd5e-ac79-47ee-95b2-a448e4f8d9c8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764690906, "uuid": "98bd7bf3-f2dc-413b-a8ea-32e55fb5abbd", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b346fb6d-cf58-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764664032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764664032, "uuid": "64b2dea0-044e-42bf-8439-e7594e2c7a6a", "comment": "Malware payload", "value": "85398c9f60865351cd0d543fb3ed881a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764664032, "uuid": "6214e0ba-487d-45f6-a855-7f423bfb089e", "comment": "Malware payload", "value": "486d85c5e1758321c312d645f2862e96be0ff5f96b4ee5745556f0c0a8d360c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764664032, "uuid": "730f9b6b-3fba-48da-8c0e-172d19d71884", "comment": "Malware payload", "value": "777cb7d48489454a884a2356b429e23d12ad1043", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764664032, "uuid": "d9ebf322-465b-420d-bce0-879335628a99", "comment": "Malware payload", "value": "1e8e0afdb265c5e5e522697915e974d6c8c1bea4da62e7d36f58ef8999705f03db7976c216b4de728646e80e160004af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764664032, "uuid": "a7e2d9bb-615f-4f5f-adf5-1bbe16d55476", "value": "T1A8E633A285508ECDC1A83BF9C44072A096713769F2F6F723A41146953E393EE87B3776", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764664032, "uuid": "bdcedd6a-3b8b-431c-8a7a-b09c6d567e26", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764664032, "uuid": "f8ceaf1d-1b71-4017-8375-38f08e37e38d", "value": "393216:mwD7vsGkqbxN8QUz+nDKK1DjrrjNFY34EhnH+2A:mwXkqsbzcXNS34E5ZA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764664032, "uuid": "5c0847eb-7430-41d6-8cef-cf905ea754f0", "value": 14407192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764664032, "uuid": "838910c9-5055-4001-9243-d7c7dc6e71fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764664032, "uuid": "9e3d7237-6e61-489a-b97c-e830c82592e2", "value": "prnwatch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69409872-cf44-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764655317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764655317, "uuid": "5da25f66-83b0-4b0e-a590-5e598bcc07c8", "comment": "Malware payload (Mirai)", "value": "d16fa1c5f1de5d4a019ad8ce8d3a4fd9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764655317, "uuid": "8e1b0900-4d9c-4b64-80b0-b652c8ba451c", "comment": "Malware payload (Mirai)", "value": "48bb0781997e199808661970a2a485a1c8823ba6635e05d913e804e7df31a9b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764655317, "uuid": "8287a183-b123-4e95-8ab7-60351b7d91d1", "comment": "Malware payload (Mirai)", "value": "ee56b103bcb95e6e20de4bc258e33afc12373532", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764655317, "uuid": "c6daaacb-115b-43c2-abce-8ded641472a2", "comment": "Malware payload (Mirai)", "value": "a41207b67b4aa97e6ab987e758b658bc139621ffefae89aad13ff18847c8274bcda5fdc661c6a56383434d195ee9d8a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764655317, "uuid": "32ac0b78-2bdf-4f8b-baf0-da6cdac9feb1", "value": "T16F5302539BE0C157DBBE8832C63F03F59E4AD291CF562F26D6D8B0BF06A5C115848E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764655317, "uuid": "92675ae4-bb70-4516-afef-5a6835755576", "value": "1536:eyMOjXm4vaH08WyusYjfCASkDi9UTnn67AQKv:eAXR8WyusYjfCj0j68QKv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764655317, "uuid": "c9125f78-56c2-4bc3-8304-19a9bb76967b", "value": 61428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764655317, "uuid": "a816211e-c4d7-4e26-b7a5-3c73ba654325", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764655317, "uuid": "14aec5dd-9f1f-44b8-baa9-79a78922e064", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51cbe317-cf50-11f0-a129-42010a9c0007", "comment": "Malware payload (MimiKatz)", "timestamp": 1764660432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764660432, "uuid": "650f87db-37c1-4bfa-b51f-740269c7a4e3", "comment": "Malware payload (MimiKatz)", "value": "ec5fa806746ba27493da43d660b60c36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764660432, "uuid": "91d0d472-efb6-4f5b-bec8-349e3ad989e2", "comment": "Malware payload (MimiKatz)", "value": "4a7f71479e004b53c391b7899d720c9a8c6c18a9c0bfbcb40f521ad2a6345c3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764660432, "uuid": "408f2963-7b66-472c-aa56-532718a403db", "comment": "Malware payload (MimiKatz)", "value": "25d2b556a007b95f35c852c1b84f7eb0f9e57479", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764660432, "uuid": "d3c05854-d104-4bdb-9ddb-0e523b01414e", "comment": "Malware payload (MimiKatz)", "value": "d7ce51e6702a39babd8d8cb92a37f3066a04061603f71d0698e018cac5558cc10fb24c0435b046a77f826b890ab27299", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764660432, "uuid": "af2518af-dfc5-47ee-b248-a24cff7e32a0", "value": "T15555E64177EA4415F2B22AB06EF1A951CE77B9E21831D54F029C854F1EB3E809E79B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764660432, "uuid": "ad4f4434-17be-4c25-a076-2f435397fc56", "value": "ff6abb25b3369620afef1dacd4a21f4c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764660432, "uuid": "03b56887-3888-44fe-ba55-35740785f760", "value": "24576:uiDjF7X3YoGq4tC1YJk+3nWBkDeq26iLutKcEY4LG:u05YjqakE3Aq2vu7E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764660432, "uuid": "ec9f881b-fbf7-49b4-ad69-f605109c740c", "value": 1355264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764660432, "uuid": "616b2c1e-5b59-4138-ab4a-cb6ae545af3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764660432, "uuid": "79be8cf1-fa39-460b-b47b-5b3f02868d62", "value": "mimikatz_4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8845af7-cfa3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764696226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696226, "uuid": "a73ca38e-677e-4e5f-b378-a39d5d448593", "comment": "Malware payload", "value": "e2591e4d64e2ce35b96bcd65d0369899", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696226, "uuid": "e56b9ebf-adf6-44e1-b139-c7acbd217f41", "comment": "Malware payload", "value": "4ae85dbcc10e8153f2603ed9035dcd75fa694c538bcea3ee5b75c56d00947527", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696226, "uuid": "75398c9a-4ca7-425c-b452-4fe5525925f2", "comment": "Malware payload", "value": "39f399e1f05d9bd8e71534747d00bc03be94bcd0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696226, "uuid": "b83444ac-3ab2-4fdc-87f6-38d2980bca15", "comment": "Malware payload", "value": "5deb46475ccb072a0b858239811b92914b4b48d44e58bb78063efee3aa6114094100b6d840ad1cd050f2c9bcfb0b6789", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696226, "uuid": "22947180-deb2-4a88-ac84-80279b6e93a0", "value": "T138D0A79524D3180ECEC54D7BABF210D41046705268514ACD39B7C1478EFC7503F41D84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696226, "uuid": "ecf345cd-5e5b-4e4c-8092-2c7817432e78", "value": "3:TKH4v/4Gr9srXAzTAJvfDFze5yRfGBnjcIAyDOOd2tLK4S8yYE7vaA:hIGrOrwz8JnoafaIUDit+lYKyA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764696226, "uuid": "451468e7-67db-4dce-9fcc-272e7b9d4a5f", "value": 230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764696226, "uuid": "3a06e4ff-e5cb-4884-bd3b-1f1f21d7ef89", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696226, "uuid": "793410a2-cad3-4f1a-8d59-ab479044a2a8", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5012e44a-cf2f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764646256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646256, "uuid": "a27d903a-c54d-44a8-99d8-42cb7412578d", "comment": "Malware payload (Mirai)", "value": "e728b03d67f62b16db92e21cf157c335", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646256, "uuid": "928dc94e-a6c2-429e-a296-f10f0dbf1703", "comment": "Malware payload (Mirai)", "value": "4bed64e5ed3071cbea2912355ebbe0216d21f2e57520223ed1ba318c8b22472f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646256, "uuid": "077d7f0c-44df-46e4-b861-ce18a0398480", "comment": "Malware payload (Mirai)", "value": "0bdb072d61d757db9c69bc50399773ce1e353518", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646256, "uuid": "1a004923-cd2e-445b-9e60-1314f39fdc60", "comment": "Malware payload (Mirai)", "value": "385b1ddc645573277f51b401b2695acb3d3f65b9f2857fd76a622444d827b2fb8c8905847901cf6cb71d4bac08cc7ed7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646256, "uuid": "0bfa8654-f358-4e25-b881-c70ef4f88dd9", "value": "T17073A9092E358F6CFB5D823697B78F219758339626E1C645E16CFE021E7024D341FBAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646256, "uuid": "b9352746-b58a-4a9e-a4b0-e157f1b4dfc6", "value": "1536:lo89L2T27mQaXcn6EyvXqaQSiIHW5VU+6Y3jfhdR2QEc8LMkRd42+T7w:lo+2TIaXIE6aZiIH0VU+6KfhdR2Hc8L5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764646256, "uuid": "65fe7954-e769-43b2-88f6-da88a27722a4", "value": 80188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764646256, "uuid": "c4c7eeb9-8c60-40b2-92d7-1cbec69f7aca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646256, "uuid": "aa87b879-1c4f-4bbc-a354-761be1aebb6e", "value": "jew.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c48679b-cf58-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764663939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764663939, "uuid": "ef824dfd-4139-4e22-9eab-f902cb53e21f", "comment": "Malware payload", "value": "a0389a9741d83bb30a03e4c48b2b9665", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764663939, "uuid": "49fedebd-4be0-45ef-80f2-a8bf43bdfe40", "comment": "Malware payload", "value": "4bf915b0efcb00ec47829fb8cb95685386b36b666b646a15fe10114716d29126", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764663939, "uuid": "63e26af7-3f98-406d-9708-12a08b455f07", "comment": "Malware payload", "value": "f9fda67bc84a178b425509e14845170d103ba758", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764663939, "uuid": "042c55ef-b024-4483-951e-fd458a56102d", "comment": "Malware payload", "value": "d48132d08d4a582cbd646a35b3684c5f6e62363eebc7894fd15c09df8eceac8295074c9985c4af27738749952a3c9a81", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764663939, "uuid": "49677190-153e-413b-adcf-43c943b1c4b5", "value": "T16307129EF368EA2FC43790324D7A123205570D62BA42E7776929731C78B7AD48F49BC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764663939, "uuid": "834a3b09-b6c5-4329-95ec-2bc1570413fc", "value": "393216:cViHiEzi+3dGywMVBuyZPeA3dijdzpVt2Q:cIiZywMjZfwZLt2Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764663939, "uuid": "f1af46ba-5efe-482b-abbc-9688bcd7b92b", "value": 18300031, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764663939, "uuid": "2d48d36d-465a-47c6-acb4-a5915bb07ee2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764663939, "uuid": "8ccd7e7c-61eb-4d2d-9d60-be512234c265", "value": "MRKalyan.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43baefd0-cfb6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764704217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764704217, "uuid": "b8178164-0c75-411d-a674-bfc3133939c0", "comment": "Malware payload", "value": "b6d0768a0d37b7eb4003eca42eece4fb", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764704217, "uuid": "1d6b4f0e-9e3b-4c73-be09-474156da40de", "comment": "Malware payload", "value": "4ca9650ba8673d9a521d4084d4b95f038d0668d095010c2887c168b41fdd138a", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764704217, "uuid": "ddda610e-4b1f-491c-86de-6013343afc37", "comment": "Malware payload", "value": "9366fb15f3bcc1492e1397f272c472c8938ac0b5", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764704217, "uuid": "deae8270-6de1-4c39-bc52-2d6b33f99fb8", "comment": "Malware payload", "value": "4ea1eee82cdd9599b05ad263995209c8e5010fa87fae9bf6f9f898b4e6758a35bcac7b3835d1e61839da6e473e2c5863", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764704217, "uuid": "11d2fff0-2e8b-4fed-86ce-ba5141d3406a", "value": "T12273528E49CB85EC9F2778588ADF8C01EFE49503112CD6E7BB9CA5E12F0243862F55E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764704217, "uuid": "822776b4-2573-4695-859c-e9e7484e8abb", "value": "768:ZOtxVDEoNPSOpFCqyhnUctbumoAoNnN6wVGUJdNaX2aeNSD8Wc5lZpbpPbqCitMf:h7ymoHNn1qNtiX5zF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764704217, "uuid": "179b9fb3-7ac3-46b4-bd4b-aacc0dd4c5fe", "value": 76136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764704217, "uuid": "357ea30b-d273-47ae-93a5-db1c144e7043", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764704217, "uuid": "1240c527-b9d2-4744-bfef-21db21dd81f6", "value": "1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73a5caf7-cf3c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764651899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764651899, "uuid": "7d86da4a-ebfd-4157-9691-9b320813309d", "comment": "Malware payload (Mirai)", "value": "62b9449718fd44d4b41cba833063f43f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764651899, "uuid": "9519f172-cbd0-4273-9e2e-1683d4656138", "comment": "Malware payload (Mirai)", "value": "4d06e07d85350be55b769f0b9358904cbcd5f5501db99502fa9ad7917f4bc48a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764651899, "uuid": "d94ea015-17ae-498b-967b-9926c83e8d29", "comment": "Malware payload (Mirai)", "value": "a3db05a84c681551c1d6c070dc437348bb3f49cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764651899, "uuid": "120a8ca9-4fac-4493-8bb4-ab975a85f996", "comment": "Malware payload (Mirai)", "value": "91c7cfa503b97b843ff8053dee3a0b925c784dde7daea98fb12d0151a27a26e5b0f80d7827c5de317e861ae6e03bfd98", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764651899, "uuid": "7281e834-b36c-4338-a342-343170950df5", "value": "T1A0C4394ABC908F51CAD53ABAFB5E82A873574779D3EA71059D140B3437CB89A0F3A701", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764651899, "uuid": "84ecd82c-ac6b-4f0f-a92b-96639e9184c7", "value": "12288:sS4QgtUaTZoiIfbe789ATkk4VUcJxAHF648/JWVvprW7Y8aif93cJw3VbEojdkty:sVtUcZoiIfJJMBUYYldkt3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764651899, "uuid": "1f3ab366-6242-4a9f-9cfa-a46860c10d7e", "value": 566816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764651899, "uuid": "0475c243-a8fc-4e98-ae53-1cde066745fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764651899, "uuid": "836eb112-319e-41b1-b2bf-dd94f9ed5003", "value": "sync.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0732a6ea-cf94-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764689513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689513, "uuid": "793cdc49-764d-47df-a206-d30b31ad4dcb", "comment": "Malware payload (Mirai)", "value": "be0c091044fe513f7f03bdeed1b8ec88", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689513, "uuid": "5ae9579f-1594-4586-a7f4-57e5d13a729d", "comment": "Malware payload (Mirai)", "value": "4d3f001406af7b2ac599e5463d8e619ab7f6bfa1a234e12f7c1a2533aa08fb2b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689513, "uuid": "1ab810ef-a769-4a01-bade-b7f8626cb359", "comment": "Malware payload (Mirai)", "value": "8a2e7ee52a95cb1ee12897e92f278f48585ba1e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689513, "uuid": "a7d20d97-ce7c-4fc4-93a8-e7d67f31a87b", "comment": "Malware payload (Mirai)", "value": "011b6db5a79a8ef4c569147802cf06ee46843f37d335cef9883b056608df48fdb02eef65d66bcfe4fa092fab7d0bad09", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689513, "uuid": "f559e172-64a1-461b-9b69-9a99de1ec1ff", "value": "T1078302EB905B81A8D52B207728467582FB013D13F84EA75F89E834FCCDE99611F4AB58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689513, "uuid": "f650af4a-ac9a-494d-b81a-15a31fcacead", "value": "1536:X+EbeQuOxOBkljJRwUd/P5MXOB8u481ugU1Xpf2hnulmfX1Bo:X+Y7uOxPEC35MMrWT2tuAfXDo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764689513, "uuid": "1e42a6d8-75f4-4062-b2d5-b39fd1513097", "value": 83348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764689513, "uuid": "7bf99d21-88a6-4269-bfef-126d3a8ef7e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689513, "uuid": "9f36ba59-58fe-4128-bc02-914256b64dc9", "value": "ecco.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "163b4489-cf49-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764657326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657326, "uuid": "29c33017-8713-4b59-b87d-4a584dfc1129", "comment": "Malware payload (Mirai)", "value": "c02635b2ea3fcea83a16119497ac870f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657326, "uuid": "5b3ded7a-cbf9-48e3-9e24-c0ccf7bb5f78", "comment": "Malware payload (Mirai)", "value": "4d96bde98ac6970629331a4d3a2ec2173711cfa739c0edba28b0f000055b52a1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657326, "uuid": "5e9c9d45-596d-4a59-83c6-1c01778d24fc", "comment": "Malware payload (Mirai)", "value": "acf471d64156c034f81526042e61bfddb01b42d6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657326, "uuid": "bf77b8a5-6fac-4997-8e9c-4c63fb214d44", "comment": "Malware payload (Mirai)", "value": "c2c71f5dde8d88b84bf12c8bb0583a12fe4b5755d0e3b6ee8032e061629f95ea2dd8e7aac0798a7e1aa957b685b0ffa6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657326, "uuid": "49bf7f7b-fdca-4761-8653-641e1e58bf75", "value": "T1A41150CF02D86D311C53CEB8BB534C596A4AC5F465C7CE88788E0957B08DE043C99EB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657326, "uuid": "df0d08e0-69fb-4e76-b4b6-a612ad85be01", "value": "12:JrWKamcytta5ZMoqwF7+MB0I+DwDNkCIjDwIMDNkijDNkG/DNk8ibS8an:g7mTa5zqwt+MB0rmkCJnkWkEk8ibS8an", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764657326, "uuid": "227a73b3-ccb0-4e5e-9b10-5e048e1b5819", "value": 1035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764657326, "uuid": "11871126-466b-4d70-b4ce-7beb241832d7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657326, "uuid": "e6011df2-bc85-4495-b7c3-671f295e533d", "value": "lll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64cc06d7-cf63-11f0-a129-42010a9c0007", "comment": "Malware payload (ROKRAT)", "timestamp": 1764668624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764668624, "uuid": "9b7f1eea-9e84-40e0-bf1c-52150e5b3127", "comment": "Malware payload (ROKRAT)", "value": "ad6273981cb53917cb8bda8e2f2e31a8", "object_relation": "md5", "Tag": [ { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RokRat", "colour": "#3F471A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764668624, "uuid": "dc9265c4-c361-47c6-b1f1-e150bd119e51", "comment": "Malware payload (ROKRAT)", "value": "4f2617a971b9c78c8b215d6cb65525ff56f0633a3bcd381695a19efe08156a04", "object_relation": "sha256", "Tag": [ { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RokRat", "colour": "#3F471A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764668624, "uuid": "6fc9d1ba-153c-4983-a5de-1f1587ec4d74", "comment": "Malware payload (ROKRAT)", "value": "536d9332e34a2332b1d027fc45b01e0e5419a7cf", "object_relation": "sha1", "Tag": [ { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RokRat", "colour": "#3F471A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764668624, "uuid": "0a8b56f0-7c1e-4d28-96ec-9c169a2dc46c", "comment": "Malware payload (ROKRAT)", "value": "e31b8d754bba648e6581849fad231d5f278cd5c676e7cdb746778a3ef93e40e8333994366f7bb610d356189b498b848e", "object_relation": "sha3-384", "Tag": [ { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RokRat", "colour": "#3F471A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764668624, "uuid": "6f265587-7ef2-4155-975f-f22c449a7c26", "value": "T1EF035B05F7C66024F6FB4ABDDAFE54A25936BC26D722A5BC4554014D0CA3FC089A2BF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764668624, "uuid": "df871598-f298-49a4-b8f3-fb1a5bfd267f", "value": "768:pq/jJ17XB87yo3tAbNmjpIjt1f9Vnf0XYshOB8oIgb:pq/jJ17x87yoGbmiVnfkXUMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764668624, "uuid": "0a355cab-95b7-42ce-973d-4312feba261e", "value": 38929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764668624, "uuid": "89a07b19-ba90-43f6-b9fe-9afa63f7d312", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764668624, "uuid": "4bc1cd22-0966-4f7f-9004-9ed76db795c5", "value": "2025 \ubd81\ud55c\uc778\uad8c \uccad\ub144 \uc544\uce74\ub370\ubbf8 \uac15\uc758 \uc8fc\uc81c.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7d3f3f0-cf4d-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1764659288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764659288, "uuid": "74fc577e-886a-4c83-9f7d-e1dfcbee72cd", "comment": "Malware payload (RemcosRAT)", "value": "e21f9bc09d3e29f1a7a080001c6e2f21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "seguritypostload-duckdns-org", "colour": "#0A0D5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764659288, "uuid": "a81efd5d-75a6-4251-9b4f-203885bf17c2", "comment": "Malware payload (RemcosRAT)", "value": "4f39b41a46a710e710b78d05f59833710755422df613fa4570d2636b222b2168", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "seguritypostload-duckdns-org", "colour": "#0A0D5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764659288, "uuid": "2b15221e-28eb-460e-acb2-ca968680b617", "comment": "Malware payload (RemcosRAT)", "value": "169abc9f149d676998894b71da0d5013065fc150", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "seguritypostload-duckdns-org", "colour": "#0A0D5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764659288, "uuid": "ad5c1501-f575-49f5-8f54-9a5645083f06", "comment": "Malware payload (RemcosRAT)", "value": "9774e6bc9cb05ee1fcc8d75d2ca819d89e6fd5b7be7b23977e62efb8e7cad06bac6918ddecd755b672c7c1b0df7d2122", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "seguritypostload-duckdns-org", "colour": "#0A0D5D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764659288, "uuid": "09e90123-e1e8-455b-9adf-266e327aee22", "value": "T127B49E01B6D2C1B2D57654300D2AE775DEBDBD202832997BB3DA0D57F970180A73ABB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764659288, "uuid": "865016be-3d81-4ebd-9462-244d8608c9d3", "value": "78a3bdf3c5b9bd3972e77fa90dce8f2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764659288, "uuid": "e14a3e4e-f8ff-457d-990f-12ef6597ee2c", "value": "12288:4N9WLGVGUYcvqvvCNQzvCZQBm+sPZu4SwN:4N9sGV5YYqzvCZQBmtZjSK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764659288, "uuid": "c5c654e6-7e5b-4486-ae95-909654616c97", "value": 540672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764659288, "uuid": "1ee4c2dd-4573-447a-b167-45062b2b6aa7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764659288, "uuid": "53e2db99-03e2-4223-af53-eb34c4cf21b3", "value": "4f39b41a46a710e710b78d05f59833710755422df613fa4570d2636b222b2168", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cd89fe6-cf39-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764650599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764650599, "uuid": "b975a525-add2-43c4-8941-f51e2f06ed4a", "comment": "Malware payload (Mirai)", "value": "110c94a85717ec97890503e878f491c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764650599, "uuid": "73ff2c92-c404-4e22-9d4e-eed19b6ced95", "comment": "Malware payload (Mirai)", "value": "503432fc5cf3544f77056d060834a6885c343cfb221aa5f8db4a9da85fcc4268", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764650599, "uuid": "7e066d4a-e777-4947-8992-c2083ff8b69d", "comment": "Malware payload (Mirai)", "value": "be554cdd1815565e149533fa84ab994b7b82b19a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764650599, "uuid": "18360a26-9ccc-45e4-a24d-1651a17094a6", "comment": "Malware payload (Mirai)", "value": "bdb01609aa8b7f3dac349ac5faca5b7adf4b19d7f47a448da21d6f50fd4fb325a52788fac3045b9a9f1464b3286b8e78", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764650599, "uuid": "e54e82c2-1a70-4684-93a7-be12dfbe092f", "value": "T1C0146A16FB0C0463CA931CF04E3F4BF9A3621A9104F99111650C7F5A6A76D77A28BFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764650599, "uuid": "98874ed1-9779-4fb3-95bc-4bec131f6671", "value": "3072:gY1J3GvtxWRpFtAsrSGTSHSSkhkJ9l2g+0q4ZEMtkYl9yPUaz:g6sx0SGOybhY9l2iRqY7Zq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764650599, "uuid": "1b9ac99e-2d5a-4311-9ba9-4438a48023aa", "value": 197352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764650599, "uuid": "936574a9-42bf-4599-b675-142670907afe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764650599, "uuid": "c4e6ffdf-c364-4569-b15f-d95986519e30", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e6abfd0-cf90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764688048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764688048, "uuid": "9cec7894-7151-4ddb-9ba6-96704121a6e7", "comment": "Malware payload (Mirai)", "value": "0b04e4a9394d8e0273b8c0aad62fd448", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764688048, "uuid": "f10505a4-e1d7-44a5-8faf-d97638dff8d3", "comment": "Malware payload (Mirai)", "value": "50c40a9696d14c3dc8a162b486dba3d5390a47f550b3120e5e6fdbbd62e1fdd3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764688048, "uuid": "a1bd717f-61ac-470d-bbfc-2fa4f792b4ab", "comment": "Malware payload (Mirai)", "value": "f96ff4246f0ed6d110da857d2fe31dc83474af45", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764688048, "uuid": "69be8fd4-ed21-4c21-8d3a-980b51a78ce4", "comment": "Malware payload (Mirai)", "value": "13c4042664fef9290dd37061e22101703f5254ac569ae68ced34dac0fe91b16c77664a50a58405632f80b4ff7478d739", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764688048, "uuid": "d41a1a0a-1524-46a3-9810-047188ff59b8", "value": "T1D3535F29F11A0B23C1D30570349EAF926FBA9BD133D0F54627BA47B56DB69232845ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764688048, "uuid": "71119561-4ec0-4362-bb58-dcf8fe8acb7e", "value": "768:enJLBsC/F/D5/wkB2RqYA1kYojGoaTA1LrKbIsZIw4vsmzhygIwoawE:GNsC3/RYWkaFU1mRuMmwgIVzE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764688048, "uuid": "f82f0d40-a8ca-462d-a50f-588e5bef2b5f", "value": 64700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764688048, "uuid": "dbec58ba-0189-4fc1-af0e-bba6e4bd1d1f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764688048, "uuid": "b7682e28-b928-4ff3-bf9b-a877ee854b36", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c078fed-cf4c-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764658678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764658678, "uuid": "d3ad2004-a803-4010-bd60-c2c05d9db8f9", "comment": "Malware payload (Gafgyt)", "value": "4ea4a49145c230aed1063eada204b6da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764658678, "uuid": "dabbd76a-a017-4184-a115-ee715c96f51a", "comment": "Malware payload (Gafgyt)", "value": "516364606a08fc316cc3fdf299f9a3c2fe7b25f70822e80a61d7a22e5dd7669c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764658678, "uuid": "e0d65c8c-dc77-4fde-add4-69639d1a891a", "comment": "Malware payload (Gafgyt)", "value": "3fabd40e65444f3f67b12c1d22c25427ec134dd4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764658678, "uuid": "36663268-cf63-419b-9da8-5fe333f30c05", "comment": "Malware payload (Gafgyt)", "value": "758ad48dde03c92bdc2e774081d6eff48b1311b6dd641ade4ab1e73ee929a9aa09eb559de83e500ed77b36f1395a240c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764658678, "uuid": "eba1b2bf-2198-4495-846e-8bae3e2fc6bf", "value": "T105E239356A1AF2B8E4C4253CF8431A742F5384687A5EE7D3A14B0935BEA7B4C7C21F09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764658678, "uuid": "000c3666-ac2f-4fd1-923c-866427c1ea9a", "value": "384:vafHsh69+Tlsa82SxaDbl/wZ5urmjXjzQp2nlxoL58SUGHKMqNGB/j8rBc/vvV6Z:UiIuslV5KmLjdnlOX8S8qHskgDZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764658678, "uuid": "43e7b18b-ee1a-4345-8171-c4e74dc7cc59", "value": 33100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764658678, "uuid": "6b1f99a4-6ebd-4a84-9060-37da756c8535", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764658678, "uuid": "7abe3eb9-6e6f-4184-a847-9330d964006c", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82297530-cf90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764688001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764688001, "uuid": "8548aacf-40b1-4f8d-81fb-8f665f49f995", "comment": "Malware payload (Mirai)", "value": "5031564098e328408327dd731312c83c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764688001, "uuid": "f500db14-32a3-4fe1-a6c3-c803a940f169", "comment": "Malware payload (Mirai)", "value": "5260e0a774f60b73183f342e90d226b1324096c905aa0cfb63405a28383a7975", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764688001, "uuid": "4b5fd13b-3be8-4cb2-a6e8-0b1a318c84b6", "comment": "Malware payload (Mirai)", "value": "2fd6f5563ba3ea814e94aabb7451395f07db3f6d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764688001, "uuid": "c50ad253-33fd-4626-b3e0-1b0247f19b23", "comment": "Malware payload (Mirai)", "value": "5d11ee424ddd6721e3858a0e80cf83217a64b10eef46df028cc8acf66231b5854e49578f1b20fdd5b6caa9c6d5e0d407", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764688001, "uuid": "b15c5140-192f-4fe3-a946-f74e3802ff46", "value": "T1FDB2E0A0511294B2D53108B4DF4BC782F78767D49AFC32798358007DBAC395FA5B82CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764688001, "uuid": "6171ae77-10d8-426a-a417-df4c35539de2", "value": "384:PlQFYe/FavPDhhugdYY/DnX37d5YoC7S0fyW8ig5dzkWhymdGUop5h7:muFDhhuXgXnYoERyvZbzkWs3UozR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764688001, "uuid": "8f414b76-579f-46ea-af96-53338476da8c", "value": 23432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764688001, "uuid": "1ec5baf3-6892-4d49-9764-1a5aad0bd551", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764688001, "uuid": "6474ebb8-6fa1-43e1-8b25-fb75b9f56eea", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cca99c8-cfc1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764708930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764708930, "uuid": "869442cf-3170-4096-a88b-dccf99688583", "comment": "Malware payload", "value": "555fb7bb8ecf73ded7b2c238fb0b51fd", "object_relation": "md5", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764708930, "uuid": "636a813e-d283-4eaf-af8a-cc35dda8d123", "comment": "Malware payload", "value": "536e5e56edd715c687aec586c2745519340bef47f08f148cf4beb4169f671860", "object_relation": "sha256", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764708930, "uuid": "dbcb9b86-e696-4580-bd74-fdcc5528c7d6", "comment": "Malware payload", "value": "a595c9e6d057334695723f7162a507d106a1f171", "object_relation": "sha1", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764708930, "uuid": "84a8170a-29a2-4f1f-b37f-2f1179c81bfc", "comment": "Malware payload", "value": "2ef4b20cca6cda2e96f7e40aa006d048490afbd11f25d6b6645a1b7b45d54479576b18e871d77524a1216c7a7b33e630", "object_relation": "sha3-384", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764708930, "uuid": "04eea80e-bda7-4833-bcb7-4b9d09d6a642", "value": "T159759B5D44B1ACD3A054FEB0F685EFD7CC9B5385162B07121FE4859A2312C83FAAB2E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764708930, "uuid": "a9022d8f-5a2a-4519-ada8-06af0bb14632", "value": "12288:hWl4y4gk8uGd8GGV0wV5Ss292rBbi7FRNFrtpkXaY0MK/QoiosWDZFDGN50kp:hG/cuBOwFpPZPpw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764708930, "uuid": "664aafc6-119c-409f-8aea-85abdb8cf4cd", "value": 1572122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764708930, "uuid": "042e4b13-2526-4403-b846-94f5f057ade7", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764708930, "uuid": "2d745c7e-8fd8-4fb4-8080-c8cf6309840d", "value": "555fb7bb8ecf73ded7b2c238fb0b51fd_a_Purchase Order.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a9bdf73-cf39-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764650568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764650568, "uuid": "28428e47-ea55-4c56-a677-2332378bf152", "comment": "Malware payload (Mirai)", "value": "8548983f3668da2db6286b793d8fa47f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764650568, "uuid": "4c9c1e20-eb4c-46d3-ad63-72faa2a368c8", "comment": "Malware payload (Mirai)", "value": "5408d16e2cf771ac0f007b992bde682c19c286bc8e54d6de6f7c2e25fe176e54", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764650568, "uuid": "113229ac-fcfe-43b2-9ad1-95957825ac14", "comment": "Malware payload (Mirai)", "value": "0fd0a3ba144a22eac71cbd95be2a4b6344823f40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764650568, "uuid": "f5b39307-6262-4f47-adc1-e292726dff35", "comment": "Malware payload (Mirai)", "value": "b278dcd723792cc04bf5cbd8dcf29da8b86347b8f805ec9f51c8f3f72b43c14e34b56a53433d97921143e6c05a190209", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764650568, "uuid": "3409d423-b30c-466a-9acb-3857c09c9d11", "value": "T1A563023656F08820EC74476790B7156BEDCF1A50F652C58EF22E73A4687FA88017F3A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764650568, "uuid": "e29228db-9257-4c21-bc3c-20e5926839f3", "value": "1536:/kJdh7fvs1P5rxNbMeOCNI25MoMvk4V50JtacbrPH:/4X7f01XJMeT5iLh5iUcbrPH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764650568, "uuid": "1c80a493-e397-4010-a20c-177108422e39", "value": 68372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764650568, "uuid": "9da75d78-6681-4c00-8bfe-e8b36b0855c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764650568, "uuid": "362fe91f-8779-4b78-b9a6-c058c9979224", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aba129e9-cfa3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764696231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696231, "uuid": "92957a61-216d-4444-908b-4782db994094", "comment": "Malware payload (Mirai)", "value": "e824d495075f426dd5403f0166b05094", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696231, "uuid": "ac3c343c-af92-41a1-8b8c-40b9a064bf3f", "comment": "Malware payload (Mirai)", "value": "549221e09e4880231c17460bf4bb8647bf26fd9f28b8b39e0e526e97a180b105", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696231, "uuid": "a5a12499-c005-43da-998e-0caf19edc7f8", "comment": "Malware payload (Mirai)", "value": "d53b9e3a722a6cb4a5f43f56eead4f357c4158d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696231, "uuid": "a53e5266-8139-4e08-a108-a2a1f1085810", "comment": "Malware payload (Mirai)", "value": "5f33b1251ffcdd6c0de6fdf15d6f97669a0484d8ab76adaeee2d06e313d2d68365cbada283ca56113bbc760885910830", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696231, "uuid": "f63965ae-0752-4283-ad23-95a789f47c8b", "value": "T127D30945FD804F13CAC522BBFB5E428D772A1769D2EE720399256F24378B56B0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696231, "uuid": "d590e4d9-9f79-4cf5-839f-6150db1f8a52", "value": "3072:5F1/Fv600t2YM42fmjD45Jocn/iY4OEx:5Ff60i2l42ujD4YcnaYJEx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764696231, "uuid": "95d507c6-ef9f-49dc-a6ad-695ffb3aed11", "value": 141920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764696231, "uuid": "8c667962-4efd-418d-b3af-c60659aab720", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696231, "uuid": "38608448-5530-4141-bb67-dcbde20de619", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3ca4366-cf9b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764692782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764692782, "uuid": "eb3c86b1-5c23-4585-a3a4-a5b4c8bbbbdb", "comment": "Malware payload (Mirai)", "value": "2cb92c035acc53fdc5063e3296afd418", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764692782, "uuid": "31ca55de-6a4a-4a47-b3a1-ddea2279506d", "comment": "Malware payload (Mirai)", "value": "554ba2bb81fa51454fd7509ae05c761b8b19716a2bfea515564faf77e0b610a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764692782, "uuid": "46f64ee8-c3ec-4053-b458-71b809c66af2", "comment": "Malware payload (Mirai)", "value": "0b85c8fda3df5afcd3078cd37aaa70e8a972711f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764692782, "uuid": "8aeab538-715d-4e99-9ce1-f86bb84e3cea", "comment": "Malware payload (Mirai)", "value": "f2ebaa3d83699b244334ebf4867062f519dac81ebc7a6bd605da9bcd0e7b2aa8e407330da03bd384780379a467049ebc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764692782, "uuid": "0b09d5f8-c794-487b-a2ae-8ada1ae5eb53", "value": "T19664EA0E6E328F3EF7A9863447B74E209B5923C727E1D585D1ACD5110E60A4E742FBB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764692782, "uuid": "f6d65186-48ee-4744-aa3a-64abcab1be8f", "value": "6144:F+ndX0U3kBEGzVX/ZanALOB7JK0cd5mRRrcLKbjHbNTMAjPhKOn3oVPfzU3/2Jby:orntTYfzUBifX+J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764692782, "uuid": "d1546353-3cab-44b0-af19-bad993d4b072", "value": 330708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764692782, "uuid": "e937de80-d455-4e89-a530-b944a79882f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764692782, "uuid": "6833ceaf-599b-4867-8c38-fdb08f9092f5", "value": "SecuriteInfo.com.Linux.Siggen.9999.14202.25202", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7db4884-cfa3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764696225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696225, "uuid": "57db04c7-781c-4de8-9120-e3ace3aff260", "comment": "Malware payload (Mirai)", "value": "e0a305194c3bf06e939ea3151f68c693", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696225, "uuid": "5f54cc07-8ca5-4202-a641-023a37e908a1", "comment": "Malware payload (Mirai)", "value": "5599e64f5cb10e74d51af6fdc826329e9e1e4228d148d295b1129e9846429013", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696225, "uuid": "1644350d-5f7d-44f1-8168-78800e68c721", "comment": "Malware payload (Mirai)", "value": "b3b4b9484981045d878ef046b4c8daa0fcca43b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696225, "uuid": "040468d2-6629-4df8-9950-393d9e1f0fe6", "comment": "Malware payload (Mirai)", "value": "71febf1c90b011135d778f46a64d4ea0803c4ce32ad91b7603297e6866172f34b86747dc57fb69c1b2b265c760d916b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696225, "uuid": "e0273c46-ee50-45c5-a06d-eb8e7796217f", "value": "T14004B81E6E228F7EF668873447B74E24976D23D627E1D684D2ACC1141F2039E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696225, "uuid": "7808128c-337c-4a0b-882b-302c2783e2c2", "value": "3072:rgDn6h+HCU+iwjsaCibfry41/RAk5uosTwFyfDR:rgDQvxiwjsadB1T52TwwfDR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764696225, "uuid": "a1e07951-2fe6-4844-ae95-88e140261c3f", "value": 190020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764696225, "uuid": "87f1a712-0bac-48a0-93c6-fa6a5e7c6909", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696225, "uuid": "798e8ba0-2c01-4e7e-9135-af8a1285c651", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "425b5242-cf50-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764660406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764660406, "uuid": "8e727159-d518-4cd2-88e3-c86c4b236b35", "comment": "Malware payload", "value": "33993aa75a234a0df907a6d9ea885546", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764660406, "uuid": "c1fc1205-5d49-46be-8c68-774ef58d328e", "comment": "Malware payload", "value": "569a827eccf3e21fdb78c0817fb23af0cd1cae17434413dc036f674ee0583ce0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764660406, "uuid": "371d224c-4b8f-45da-93ec-caaac42c6ffd", "comment": "Malware payload", "value": "47a4b3a34ff200b3bd44bf5bb20818a6c9a833d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764660406, "uuid": "485b599f-1297-4482-985a-2adae352daf6", "comment": "Malware payload", "value": "1e2db835d57290d4c0cf3400c95f690bbd7dd5ab5165b61abe047aee6fdfd19205f70b44fcdf5c5ca9921fbd673e8806", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764660406, "uuid": "8b411ecd-d978-4dd8-ac7d-9d9ab1df2fdc", "value": "T194463A07FC9945E9C0AED2348A729252BA717C491B3127D73B60F7382F76BD0AA79740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764660406, "uuid": "102c73df-4c0c-4fea-8ba0-61de6f4a9a69", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764660406, "uuid": "7e599164-5830-4038-8c93-c0a71ac39d9d", "value": "49152:ZNNb+59CkYCWU+xJrCO5/xBWTQ/kItsAACdufztjK5EZr6CTXj3TaOJ+Pm:Va7C2YCO5/zku5oSEtzDaDu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764660406, "uuid": "e59ce6c0-f386-408e-9647-70c4287e259b", "value": 5405696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764660406, "uuid": "938aa755-0c02-4500-a52a-4d16215f8762", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764660406, "uuid": "56a3c70e-e751-475e-ad1b-b4c3ce4b01f7", "value": "agent443.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bc47384-cf94-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764689520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689520, "uuid": "87c30fab-63a1-4cbb-881c-0c9b45e35d5d", "comment": "Malware payload (Mirai)", "value": "9891e655e086aa152bcdbbe77c71ac16", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689520, "uuid": "8a653fb2-7f13-49bc-a6dd-d9e74334295c", "comment": "Malware payload (Mirai)", "value": "5718911d55aca6a3a117104d4903bfd76cc234fc725a38729f0ee598923c7c8e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689520, "uuid": "de6c43cb-4bb4-40c6-a075-d3c1f76afe6a", "comment": "Malware payload (Mirai)", "value": "e055471335c682d668adde20ff1f7ea8b30c115c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689520, "uuid": "4db5f84c-be52-4b5d-8c7e-16749d1f3683", "comment": "Malware payload (Mirai)", "value": "883cf8a101392eedde513e2f62bc5a59465df8cdaf947578dd71f7358e654ddb463d82dea82a8cbcfbbb5018a43be0bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689520, "uuid": "4055043e-a8dd-4525-a578-5e55953c9288", "value": "T12C7302BAA46BFAA0D444EE3ACAE986DF51E20D3F05C56E61B0344331C6C8E9B437D641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689520, "uuid": "b0b9f7f5-1a45-4fd8-933a-e34fcfe5de29", "value": "1536:BB+hx5PYJyiBfAMffXjjvzOhLRktbhKt928P6y84SXiO+TLNzj6:yx+8iBIMHzjLOhLylGCR4Oi9LNv6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764689520, "uuid": "5026a120-c101-4f4f-b10a-7a7d83397923", "value": 79752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764689520, "uuid": "61b1927f-cd01-49c1-ba49-a208a30fc6ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689520, "uuid": "52198627-4487-4ce7-97c2-3377e300b6ad", "value": "ecco.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a23bde4-cf6e-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1764673331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764673331, "uuid": "4240e79e-232d-4ce7-83d6-71cd9aa5bce6", "comment": "Malware payload (Formbook)", "value": "b4b67dda46c13d8a031fb67a7219b9aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764673331, "uuid": "2ff30786-c0c4-4ad4-bb5e-4669f24a242d", "comment": "Malware payload (Formbook)", "value": "57613c05c430ca628506d91721abd51b0af0cee49e2d94c0fafda3b5c0d9e4c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764673331, "uuid": "f451a6b0-a48b-44d1-b6e6-970df42755e9", "comment": "Malware payload (Formbook)", "value": "a47c334f21c4aa266fbd7fa435e9c9ba7ff0bca0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764673331, "uuid": "012b3be7-17f7-4196-b0ca-4a9b3120a1f0", "comment": "Malware payload (Formbook)", "value": "e3328a3fb052aba80fbd3953dd57c871a4c7c053a585534f295f365868f502d4929f6d2b6c402110c0744e303d7a9cc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764673331, "uuid": "1acf981c-7ce0-4e87-9685-ecf79d2343ae", "value": "T10DC401585AD8D20BD4661FB46C71E1B02778BEAAED21D10BDFCA2DCFB4BEB484055213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764673331, "uuid": "29e0477e-b075-4b0f-ba09-587878c9a82c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764673331, "uuid": "a8b51812-256f-426a-a18d-d7e65a41854d", "value": "12288:PdnT5qIrXh7T9oXqxmp4I3oXu8YyXQbXC37n2nrh+mau:P9Y+xJZ0pH3XE137n2rcma", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764673331, "uuid": "3aa0c68a-354c-4df5-bce1-9c3bb93a84b5", "value": 562176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764673331, "uuid": "43b75213-a12d-47b8-a7bb-6ddd72f075d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764673331, "uuid": "9ddd714b-8f25-4369-9e6f-a6334f37beec", "value": "AsfMYqX60k8aEMk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed2f9607-cf7b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764679161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764679161, "uuid": "4c4e7e21-30ae-46bf-bbd6-402f8ce1bc8d", "comment": "Malware payload (Mirai)", "value": "e641ee806d395620705885f2c5e17269", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764679161, "uuid": "1a473652-5ffd-488a-98a9-25b18b868a51", "comment": "Malware payload (Mirai)", "value": "5774cbcc0fab1db274ecda79b6bc50fbbc6933a189f6cb762acd70dc46d13135", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764679161, "uuid": "75376ca5-b9b4-419b-b67c-fccbc4c8e66f", "comment": "Malware payload (Mirai)", "value": "3db9ff6e7945c06b3ac1cada2494e1eeda809829", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764679161, "uuid": "e3936f58-f27b-4dab-9365-91dd0340e563", "comment": "Malware payload (Mirai)", "value": "1fcfaf127f83fb2926adf30701117ac38b19a9416fb2c7ad07c8e2af491c4ff843ad4868528485fd7174d939d01e344c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764679161, "uuid": "f161bf72-b055-4383-87d2-525fce1df9b8", "value": "T18CF33B80F58745F6D807883060E7F33F8E31A5A5917BC65DEFC95F32EA27A41512A28E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764679161, "uuid": "3f001248-48ba-4900-85ee-fd6670339562", "value": "3072:7MHIZtu6xyLhHrdQA7av8b53m6BFdo+E2cauNBHo9s:zzu0yLhH2A7aEbtr5eNBHo9s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764679161, "uuid": "b1d7cf3b-b67b-46a0-bb59-6b90e40cff69", "value": 170672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764679161, "uuid": "f69466b2-9742-4dfd-ace3-e84d88b237db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764679161, "uuid": "8732ad52-fa6a-4422-ac21-76607bb25177", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8afc569f-cf9b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764692740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764692740, "uuid": "12660b40-558f-4306-96b8-e300538c8a26", "comment": "Malware payload (Mirai)", "value": "6d86a21eaef996dd8bc86f17410a8be5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764692740, "uuid": "f0f21d7b-c709-4888-9dab-ced97887c0e7", "comment": "Malware payload (Mirai)", "value": "57ce50bc2476b370c09b7d18954e0faa32139212d129a6cf9355a7e92af335a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764692740, "uuid": "ee5af3a0-9928-4f6a-83bb-97f7383677d7", "comment": "Malware payload (Mirai)", "value": "05150d3a9fe5d8fa04e6225a371c18e4658e43cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764692740, "uuid": "f058557f-0a80-4e8f-afae-242fd2517afc", "comment": "Malware payload (Mirai)", "value": "f4449fcb655cd629a51dd3c2dd9132e2451907be2117a7dfa81ea183437f7c8d2a93a8bfbb9c521d673d1f7ac8862b83", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764692740, "uuid": "e933d985-ace7-40e0-8b69-e5e773aaae00", "value": "T1F19301F8B28115D3ED83A47950D4BAA8EA180A16F3E4FD4FE55421B70DC89BC2C94EA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764692740, "uuid": "dd0d840f-9c05-49f7-88b3-2fb5f4e1de76", "value": "1536:Fe/0HvPcOdQiVnHy0KAfgwS7z1LbrQ53LchkkkG0odnBihZFrqBVKmQnfx5RbVJ8:U/0HvP1dQiZfgwoZbK4IoZBihDqBFQfq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764692740, "uuid": "b58fa63f-0021-4ef8-a1f6-7889e373b3c7", "value": 89700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764692740, "uuid": "a05d0b54-fbe8-4d00-9a8d-9f5fd43e28bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764692740, "uuid": "d5c20cf7-ae9d-472b-9f42-4977da707052", "value": "SecuriteInfo.com.Linux.Siggen.9999.14202.25202", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa18a429-cfa3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764696228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696228, "uuid": "7343ef5d-75ad-497c-b485-c4d8d8bb62b1", "comment": "Malware payload (Mirai)", "value": "1261e7c5c86823c9d6cc5168e96b53d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696228, "uuid": "ae373855-65f5-4daf-a231-2db14f6eac2d", "comment": "Malware payload (Mirai)", "value": "588ac8b1bdff3f0b36c0c881c129e86d8b54d1aa77905efc1356e58ffd3808aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696228, "uuid": "94359cd2-a324-4dcd-bff3-5e32b6825b70", "comment": "Malware payload (Mirai)", "value": "571061905658e42d129f7ead2acedbfe3e78e3f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696228, "uuid": "b33000fb-b131-43f4-9092-463f05368325", "comment": "Malware payload (Mirai)", "value": "107713a565d11c9934c0aa885a447a7eba801265cf27f53089773c767019551045d38cc68156cb7d9e99fc734e5c5137", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696228, "uuid": "42bbecb3-230a-4585-8c4e-668632ffce7a", "value": "T1C9D31945FD904F13C6C522BBFB5E428D772A1768D2EE72039D256F24378A86B0E3B542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696228, "uuid": "7cdae54b-2e2f-4273-acc7-928a4e9d0027", "value": "1536:5Rfo+OFPCREW52OpJW0y22hXG4VqowTJVHsGU0NV1w1y2Dl+nTwywb1i9iHK7oid:5RQdEzpk0y04XwdVHsGF1Aydj4DRq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764696228, "uuid": "bbbace75-6580-4037-96e2-f775885044fc", "value": 138144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764696228, "uuid": "133fa37e-0f9f-4eb6-8184-a9848858f671", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696228, "uuid": "57486ba5-5b30-4216-99e1-09dca19e2bf4", "value": "nsharm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11147820-cf5f-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1764666766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764666766, "uuid": "fd549cb2-0da8-43dc-95ba-00cb3574ec1c", "comment": "Malware payload (ValleyRAT)", "value": "e84cf90887e5403dbe365f7a4b47d3fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764666766, "uuid": "03949010-4593-4a83-84f4-6425ddb5cdd1", "comment": "Malware payload (ValleyRAT)", "value": "58a50b3ed5f133f29b1004ab5495a6f651d5186310d80572e89d9e58940a1381", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764666766, "uuid": "f3b2f1a3-904f-486b-851f-5f721cd5477f", "comment": "Malware payload (ValleyRAT)", "value": "53ef1088f5e7c07e6f4734c8c9dd1448c27b64a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764666766, "uuid": "a6089d27-9566-4a51-96a4-555962c81e10", "comment": "Malware payload (ValleyRAT)", "value": "611a2180c85a45b122bbb220745cc96c53cc9e596706204c2c0cf6d928adb77daae61f8d3c517c1c10d1658f266e5bc8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764666766, "uuid": "d3c1400d-7d4f-408c-8b5f-be12c1718bf3", "value": "T1C7B57C17B75901A0E166E2B891838706E7F07C568322E3CB53B6D66D2F577D0AB3B390", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764666766, "uuid": "cf733c84-3652-47df-b2b6-629c36ee6ddc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764666766, "uuid": "f01ec049-fc52-487f-b945-285887bf8428", "value": "24576:SK6XezXrD89rxZfQEKZm+jWodEEP53wrEKnC9CYTTb6EyoD89rxZfQEKZm+jWodi:V60I9rx9nrx0Cib1I9rx9o6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764666766, "uuid": "ff09f529-e605-4861-b6cb-31df226fa517", "value": 2392808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764666766, "uuid": "1b2c0f68-a0b9-4eb7-9bfa-0e798db3c334", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764666766, "uuid": "186d4e6e-8d5b-4d08-bb2a-122f668cdd43", "value": "E84CF90887E5403DBE365F7A4B47D3FE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da92a2ff-cfb7-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1764704900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764704900, "uuid": "30931a8e-29c5-4a07-874a-9ddac2a25e9f", "comment": "Malware payload (AgentTesla)", "value": "9be58f3ae37d3fd38f27ac51afb4dcf0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764704900, "uuid": "50e1d990-dee8-40c0-b541-ccb463db0486", "comment": "Malware payload (AgentTesla)", "value": "59158c6b928e5408194fc8f5b7332ba667d667bf5f511d6c17230a475b3e07dd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764704900, "uuid": "7e8c3a0e-4b98-4823-8ac0-ae662c5fd953", "comment": "Malware payload (AgentTesla)", "value": "6f131e9eb6e85895172a8e645dd8400f18dd6c28", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764704900, "uuid": "910fc287-de71-4690-8445-9fd190d82d47", "comment": "Malware payload (AgentTesla)", "value": "adbf4c1118aa15aab23d3760aef8284b41142a02b8ddb66ee72f681dce99d522a4b107c0764de8fd5fc08c3e1f7a9eed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764704900, "uuid": "b2712451-617c-4cad-9350-573b7f6352d7", "value": "T1BA745C20ED34067A0F471B9AFCA50B62CABDC619462650F5F6DE070D61069FCE3BE369", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764704900, "uuid": "4ca3c5c8-1f5e-4581-8665-68c082d45cce", "value": "6144:0YkCuQdagSnhHw/Lb+stBCDubRmu8EQvuNXvGD5UW/xkzdRT4MvUpdv:0YkDgP/mstcaVGVbF/iRAj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764704900, "uuid": "21aa0d66-88f4-415f-916b-8bb15a75a212", "value": 347912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764704900, "uuid": "c895ae0e-6f4d-4e87-97e8-b69fcc08e378", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764704900, "uuid": "e7d9a899-4099-4403-9bb6-65a7da714ec6", "value": "CONTRACT- 01-2026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76d7b8be-cf44-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764655340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764655340, "uuid": "a96df0cb-3c89-4d2e-998d-f3b5205a57f4", "comment": "Malware payload (Mirai)", "value": "5143f0c52c8834728f04bad94b1a7191", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764655340, "uuid": "d14c2b9a-b44b-4113-b247-29b8f566363a", "comment": "Malware payload (Mirai)", "value": "597aa97ab884a7d6e5639aab5f4bfee55e04c76e74d8ea86b4ae8d8509efaf7e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764655340, "uuid": "a4f5ff65-2b47-4071-9a82-825a29c1844d", "comment": "Malware payload (Mirai)", "value": "ed3387a1d55dd42cb899ac41ed1a484cc9abcdbc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764655340, "uuid": "a175cb77-6714-48a4-8ad0-3af60bd9f593", "comment": "Malware payload (Mirai)", "value": "7c88034831a0675227ee23614a2249b3611e604abeb063d1f34930f9bddb360f9cf761a86b33096b6d4d8d3fb7df6e01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764655340, "uuid": "7cdd923f-95fa-4d7a-92d4-77b741598ffe", "value": "T1F6C33A0A74D230FDC287D131566E9F21E936B4AC02187DBBA387BE711D36EE12E15E61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764655340, "uuid": "22f33688-26f9-4a40-a01d-25a949bb9d89", "value": "3072:xo+3af0V/ttnv2CXwy1uQe3+uZ1EV9A+Kg:xSf0V1WQe3+ubI9+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764655340, "uuid": "b16bacd3-1c44-4f15-91d2-cd684a6ca3eb", "value": 127968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764655340, "uuid": "37212626-46e0-4b5a-a445-d59113520870", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764655340, "uuid": "e6ba6884-ad30-49af-934f-e76ad25d2a9a", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "972006e1-cfa9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764698774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764698774, "uuid": "a37d37f9-06b4-4d2c-a0d8-0216c134d935", "comment": "Malware payload", "value": "6253faaf4ad2f3ceefd1ca53286c7cdf", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764698774, "uuid": "f03ce19b-97fd-48bc-b88f-0469beca6bd5", "comment": "Malware payload", "value": "5a443230aae83cfc0074b9e08ccbf4b48ebdafbf5e15f6315ed76039499404f5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764698774, "uuid": "2230d92f-b15c-4e62-b3d8-e85a1a089041", "comment": "Malware payload", "value": "a5fd14bb69a40cbda550df6a4720a13fbefac295", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764698774, "uuid": "868378ef-72aa-4c04-bd7c-e9f84f91c626", "comment": "Malware payload", "value": "4b8288716b2790344b2b80da096f0ef5956bf2351b9a39f93d47005edc272fc55d601d0feaed497e08f4cd645b2603e5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764698774, "uuid": "e70f1ed8-796c-4df6-907f-fb321c06b6c6", "value": "T1AEF01DEF809009621CC0F90C79A34C2CA00E66DA2EC60B8CEE6D1C353EED91DF415F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764698774, "uuid": "f4246d1d-57d6-4a53-afc6-300bc953cc83", "value": "12:t9GCoZD4ChHWhyEhHWkBzvXBzMHWknIjDXnIMHWkiDXDHWq:t9GCoZkCRWdWkBz/BzGWknYnhWkizbWq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764698774, "uuid": "ff656c94-4809-4e5f-b299-5a436dace67f", "value": 647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764698774, "uuid": "abfb8a9a-1b66-42c3-90c9-e5a997c23fe9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764698774, "uuid": "71f8b6e7-dd40-4d79-858b-d507d285f8a8", "value": "dvr.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d664d059-cf7c-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1764679552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764679552, "uuid": "b53c27c6-ae62-4eb3-a8f7-a93cf06a196a", "comment": "Malware payload (RustyStealer)", "value": "c70911de2bad51a9c008bae4d0255b4d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764679552, "uuid": "828ae945-9ad3-46dc-bb53-ad968b51154d", "comment": "Malware payload (RustyStealer)", "value": "5a451b70abb22a517b0c09f61de89b31c92366aa93fe1fd43ca51ff9a3324768", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764679552, "uuid": "91365d20-560f-45ea-b2e4-7749e199ef8f", "comment": "Malware payload (RustyStealer)", "value": "ab9a7891c34b76d393538bc7879f2b8969d3d6f4", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764679552, "uuid": "30eaa8f1-aa9d-4762-81f8-f9501cb67cca", "comment": "Malware payload (RustyStealer)", "value": "1aab5d9ccffb5c3fc009c1a3c06d355351c1fed04b4ee016a8445f96096a1e15708f5d7aa4c218e91e5da86c652aae7b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764679552, "uuid": "093fa653-7302-4a8e-a4aa-45eeaa1b1da6", "value": "T15574B019FA1669FCE55BC074834686637A26B0CD0B2179FF12D842387E69BF11F39B48", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764679552, "uuid": "651aa399-f4bb-4916-9028-20cdbaad1d62", "value": "ea18bc4df589419f6162a97e4ae3a39d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764679552, "uuid": "cac4c8e4-422a-4309-b162-360f46a09ee0", "value": "6144:7BUoGCCyTjBd66wchUi3rvaGHujqnF2KHWNUmG3kbQmCVIa1EH7:tSymjgHH923UX3kEpI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764679552, "uuid": "3b7918f1-dee2-4ff9-92aa-9f4e3e6dc3d6", "value": 358400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764679552, "uuid": "9eec9bb8-ec38-404b-9351-d5c9ef9edc6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764679552, "uuid": "a766b163-78cb-4e15-bca5-4d6a8601c728", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "616bf6b0-cf58-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764663894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764663894, "uuid": "c5455f07-d12d-485e-849d-b7cf0ea61fec", "comment": "Malware payload", "value": "daac22f8b9e01e77e67a2de8f3a7d6a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764663894, "uuid": "7f4f63e9-3ca4-4c72-9d52-b45180438c64", "comment": "Malware payload", "value": "5a6a61a3a8b09b28a9c5aa9673f480f669383f30a8ad5bb2cb7c30f11fb4e955", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764663894, "uuid": "dd272319-6936-4752-bf47-ef7f0097c29c", "comment": "Malware payload", "value": "ceec6c507d1a9afdc33caab64092942ca4aaeecc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764663894, "uuid": "352e35fe-e0f6-4891-9458-c24023c6345b", "comment": "Malware payload", "value": "8e18adc996aa5ac23e8525d6edf1a7ad8a73c0371f67bace6ecf9b5ac72c5c26030a26d11e96b9c284d971d77bb0bae9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764663894, "uuid": "fa57ad42-9afc-49c2-a682-de4d7dfd75a7", "value": "T1B4B47D05E7A408F8E0B7EE7989524902E7777C490F618A8F93A567661F733D09E3A331", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764663894, "uuid": "9a159abc-bb00-45ae-8a33-191a564c7a6d", "value": "b1c5b1beabd90d9fdabd1df0779ea832", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764663894, "uuid": "a56fd50e-e9a4-464d-8724-da7b55a9343c", "value": "12288:cCQjgAtAHM+vetZxF5EWry8AJGy0y4O27nsJpk:c5ZWs+OZVEWry8AFBx27nsPk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764663894, "uuid": "10570cad-a590-4b3c-a80d-dfb64b3b5981", "value": 506416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764663894, "uuid": "059376a4-516e-4bf1-99d5-d71ecf1b404f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764663894, "uuid": "c7d4a28c-7980-4d8e-8ae9-796c30589065", "value": "Agent_Uninstall.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e9b5411-cf2f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764646253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646253, "uuid": "d0ed86fc-42b3-435e-899f-5c2295a6267e", "comment": "Malware payload (Mirai)", "value": "75cbae22488503f6d811e4aadb409c60", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646253, "uuid": "27b36945-12f9-41b7-9fc7-db0f3b88dff8", "comment": "Malware payload (Mirai)", "value": "5aa15f4321ce3007df5940f2175bdfa619a5e8a8133fe36b939be3d6811db483", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646253, "uuid": "8d696b86-babd-407c-9f06-df64d6079620", "comment": "Malware payload (Mirai)", "value": "540136576501670bcb14fea1c454c9b644a678b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646253, "uuid": "3ff299a6-635e-40d2-9c13-0deb9c5cea70", "comment": "Malware payload (Mirai)", "value": "4ad202451b15ce65d3b7df0dfdaf6dd0a60be545ef33319313d7d6dfdc400959c45a2bd578344835f12e8aee5a41c133", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646253, "uuid": "b5f617e2-5c32-454e-93bf-0a741adbbfff", "value": "T193D34B46FA418A13C4D513BABAAF41493332D7A4D3DB730699185FB43FC67AE0E63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646253, "uuid": "3959d21f-2739-4646-96aa-63dac3a8e457", "value": "3072:5KacBqVuJVkW1cIOPZoxNOqMP0wctzHn9PF+84/M/92L18Yj:kacBQuJVkW1cIOaxNOqMPVoVF+8MM/9S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764646253, "uuid": "f9751d01-4897-4fbd-b4e2-bc83540688b2", "value": 136482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764646253, "uuid": "103c26f4-ee3d-4855-bdb6-c494a77ab896", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646253, "uuid": "cbe076f1-a0a2-48fd-85d4-fc66da79e738", "value": "jew.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d75b2794-cf7e-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1764680413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764680413, "uuid": "36df4ae6-c5c0-4e24-b518-ae791ef4fffd", "comment": "Malware payload (QuasarRAT)", "value": "8d4a77e1fc1ba4ed1bd544af53500551", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764680413, "uuid": "0445305d-97d9-4a48-ab4c-0a421e16348d", "comment": "Malware payload (QuasarRAT)", "value": "5b55a5d95f541d3d1c214926893f3187f0a90d4984e673c81c28edb23576c286", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764680413, "uuid": "bc1d6b80-0102-4586-bbd4-4c8e3afe8e71", "comment": "Malware payload (QuasarRAT)", "value": "1ed585628d516661001127ed698b0eb5e8000349", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764680413, "uuid": "31ae66d2-0390-4e4d-b0c6-935966d4d88b", "comment": "Malware payload (QuasarRAT)", "value": "8fb6fbf80ea0ca66ab3a71b360656e674854b860466e797902eb0afd969608762c2334a1484e77d103a04a0a2866cc2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764680413, "uuid": "50f81dce-94e3-44c4-8750-4d520f13036c", "value": "T11DF533FC339260DFD05BC6328B661D3464822DAF1B19A25775277E9B763E1C24F214B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764680413, "uuid": "6039a60a-2c2c-4c64-84fc-e62522de5e8f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764680413, "uuid": "5e249ba8-93cf-4cde-8a2e-1f6128df8842", "value": "98304:FkFQ4LY7apc31fd81oCQkhyO+524hlkiOX5P:IxL4ccl2uCQZLh1O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764680413, "uuid": "4cd396c9-8da4-4e54-b3e6-6a4e6f0a25f0", "value": 3400704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764680413, "uuid": "3d44a737-1958-4a28-aa21-ec01c51e7929", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764680413, "uuid": "f05ea51d-8aed-4912-b125-c43d1bcdf6a7", "value": "rPago_Transferencia_1222025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "909ed8ab-cf25-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764642069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764642069, "uuid": "0abeb4c1-3230-4bcc-9dfd-6a008531dbaa", "comment": "Malware payload (Gafgyt)", "value": "6639dd9e87934d8a4d984dd41c683009", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764642069, "uuid": "85e04e67-b663-4c44-8a8d-295e13b93ee2", "comment": "Malware payload (Gafgyt)", "value": "5c0aa6358412a72fe1aa35e8cd1c2d4b210c7dbbf4add55533431b8d3d5afc38", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764642069, "uuid": "ba93309e-81f5-4696-9d35-1f21ed382d32", "comment": "Malware payload (Gafgyt)", "value": "5ef3a2445aef60f49bf7dc492ecac4a00ea389af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764642069, "uuid": "0a275815-0cca-4444-9ca5-cbd7c9c000aa", "comment": "Malware payload (Gafgyt)", "value": "ef1b8d38b19a5a0c5363249529436113970c148849f7bc1424f479f11343e6c0eca6c2525a28761037d7d20a78c23342", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764642069, "uuid": "5b62b502-97b4-4695-9a72-c9b8488391fc", "value": "T13462CC7E6E21BB3DE3788B3207F53EB8C31A019622E2C345E1BDC5155EB525C48DEA64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764642069, "uuid": "438341d8-b4e6-418f-a38c-93fd2dba561d", "value": "384:R1FcUF6yYQFEw5NuH/I4+PG3rE71mH72rK9GALywtG:3FcUQyYQquN8I4+PIE7QH72rK95LywQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764642069, "uuid": "d5bec8e3-56f6-4328-b859-ac64721f92c6", "value": 15720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764642069, "uuid": "d322242a-5375-4c4a-8787-680373b99b50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764642069, "uuid": "0e0f9d21-10a2-4baf-a9ee-b92c86e90a25", "value": "SecuriteInfo.com.Trojan.Generic.36845231.29111.20963", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32abfb48-cf3a-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764650931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764650931, "uuid": "817e361c-47db-4dac-a896-de6fffd28cc9", "comment": "Malware payload (Gafgyt)", "value": "60d466e4d79eb4cc9a27ef9cccc3d9e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764650931, "uuid": "74ecb0a7-da42-4f83-871f-8cab4b607ebb", "comment": "Malware payload (Gafgyt)", "value": "5ca5a8f2e0e3c6ab8b0b3469fee5589b039e3d14e6538277831e4ab98442fe52", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764650931, "uuid": "7da608ec-17e4-444d-8a1d-6035e4b417da", "comment": "Malware payload (Gafgyt)", "value": "2cbda58e543dcb1acba2f2bca71479ee2b901794", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764650931, "uuid": "983b5e01-7097-4631-bc6b-3594a88203fc", "comment": "Malware payload (Gafgyt)", "value": "ebbaa37bfb8071acd41bb5db788e6d6f2792d2cd4de58b395b68ba10c3c0b0b56b45cd04b05d248fe44062a4d5e58e60", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764650931, "uuid": "b2aa0896-ad87-4d49-bd4a-737c62a4a409", "value": "T117E31814F801476BC2D323F6A65D879D3F3517E623DB33115A38ADB02FC2B992D299A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764650931, "uuid": "acb68f04-2c6b-419b-aa8b-b3e48cc81574", "value": "3072:Oh8pDxLxO0PXW8/2lMq9/5hBke+84FmzZQQAhtRq6AAe:lm8/2l9/5hBkeWFmzZQQAhtRq6AAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764650931, "uuid": "5081e422-f9d2-4958-8fc2-ce86f6ee99a3", "value": 156077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764650931, "uuid": "099ead30-9fdd-424d-8d56-ac9f6cd210c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764650931, "uuid": "9f6e84cd-3590-49ab-8da1-5b52de6fdb6e", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81f94ee1-cfca-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764712911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764712911, "uuid": "c5004130-84c5-4792-8046-1fb1015a0324", "comment": "Malware payload", "value": "01f22e75af63ab43808aff5301e4b214", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764712911, "uuid": "4b3d95c1-e483-47b9-b53b-410ceffba4e8", "comment": "Malware payload", "value": "5cc94df1b5321d6040069543aaec416ac5b68e7cd301cd0ebca68d4705f72b1c", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764712911, "uuid": "719d6638-67df-4ddb-8160-dc04fb0e4139", "comment": "Malware payload", "value": "cd8a1cfaf7eb3a9a04fbc5e5e0a7a8fa81f429d7", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764712911, "uuid": "f986545a-0aaf-4e2b-bc3e-920385a91f6e", "comment": "Malware payload", "value": "1431a65f2f84f48ab8535531798f2f5e508be61c77a236d6942c8994a275bed48aa17bb72b37cf39bb5077f80df1e2b4", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764712911, "uuid": "0b7e1758-3e54-4a1a-b898-c1f8579bcb52", "value": "T1D0E2E12C3734B948DA9F0DF1228F554B8A744CC27859C4227B8178E07DB25B697AF6CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764712911, "uuid": "0ccb2f71-56ed-4e71-93ba-dc664a4e8fa1", "value": "768:mzcAGJe5Q7YPBnrWOzuzZB4w+IeQoTuPmMagfe7rl:NAGJe+7Y56Oqzsw+fx3gfe1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764712911, "uuid": "61ffe2f6-a436-4759-8cb5-eeb689e9392a", "value": 32555, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764712911, "uuid": "60a67237-9c66-4cac-88bb-2d4e475d80cb", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764712911, "uuid": "7446686c-f38b-4e14-87a4-a6efeec8a4bc", "value": "Krypton 1.21-1.21.10.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5529b03-cf9b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764692784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764692784, "uuid": "29915276-4f22-404c-9450-d0446e16e407", "comment": "Malware payload (Mirai)", "value": "1956c94c627890c84c84498fb8f23b0e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764692784, "uuid": "65ae3d45-bb02-4d72-93a4-7d334d2b48f0", "comment": "Malware payload (Mirai)", "value": "5d30356689e036d648d40573d918b584eebab0e9cf82a545b8a8e8befd4f0867", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764692784, "uuid": "6ae13896-6fa2-405d-aebe-f5cb88db1c18", "comment": "Malware payload (Mirai)", "value": "5fe9660f1f08553f1e0f0ba93aec9d1889f7ee4d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764692784, "uuid": "dd453297-ba6a-4e56-b2fc-781b4a115ec2", "comment": "Malware payload (Mirai)", "value": "0f04affc796b806d3ec1aee1c49c14a244c84be4207dd3738bc37b23dcd185948ae240a927046322ae4ef1e5825f97bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764692784, "uuid": "7253d79f-1795-4097-aef5-60e010deb474", "value": "T118443B46F8818F25D1C016BAFA2E114E372717B8E1DA72129D245FB47BCB86F0E37A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764692784, "uuid": "2fcca5d8-2cbf-44bb-8682-4c49868ed0db", "value": "6144:bDVeuaXKFUiKf5c8JDkXzmUaiRvdpRkiSseQ:bDbaXKF0fG8JQXKUaiNXRk0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764692784, "uuid": "76a9b0e5-7b27-4802-845d-2735f93dce4b", "value": 265916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764692784, "uuid": "6012523d-85b6-4eee-93f2-285c04ec35be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764692784, "uuid": "cba231ae-2e11-4a56-9252-efcdc2d6d21a", "value": "SecuriteInfo.com.Linux.Siggen.9999.24892.13666", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4795c54-cf95-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764690260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764690260, "uuid": "7574649e-94d9-48a2-882a-92f912af8c93", "comment": "Malware payload", "value": "61b59eb41c0ae7fc94f800812860b22a", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764690260, "uuid": "7fa9ca91-b732-40f9-9875-a0b5ba62a986", "comment": "Malware payload", "value": "5e14181839816bbb4b55badc91f29d382e8d6f603eec2ed8f8b731c35def6b59", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764690260, "uuid": "d7132e36-c6de-4f19-9069-35bac9b78d4c", "comment": "Malware payload", "value": "731a13bad6316fda68c9d57fb4e562dd0c1130ce", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764690260, "uuid": "9336d426-9090-434b-8293-22a16e0150fc", "comment": "Malware payload", "value": "60e769c85e1b80072647b347c87b1cca4b549e41405a9ffd4ba127c51a7fadc0e8be902413be5633f84c45c7eb95479f", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764690260, "uuid": "16bdc792-427c-4d12-a4ef-567bdbd54494", "value": "T187B6128BFB88999EC0F75332C53952A281474C228B83DA835D58777C58BB5E05F4AFC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764690260, "uuid": "0cb09886-9e75-4602-8c14-cc86c99de617", "value": "196608:j70jGwWjfQAuqkw5LSkNNN7gvDjaYs4qc34+Mwepy2LQDdHdIULhkSvuh:0HxAqwckNNN7gvShQ2y2LQDV/h7uh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764690260, "uuid": "952a3375-22a0-4dee-9c3a-68d46c8c78ed", "value": 11178730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764690260, "uuid": "d43c229e-8107-40ab-b596-6520b0d151eb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764690260, "uuid": "9812bfff-3d94-4e83-b672-22b55bf658e0", "value": "5e14181839816bbb4b55badc91f29d382e8d6f603eec2ed8f8b731c35def6b59.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c307ae99-cf58-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764664058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764664058, "uuid": "6f649180-be3b-4c88-8605-a77e678040f1", "comment": "Malware payload", "value": "70d668ee7892393824f31c73d5d445fb", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764664058, "uuid": "c0c87dd4-a134-4c1f-ad35-7be80dfad2d8", "comment": "Malware payload", "value": "5e33919c9c8b9b771de9edca9b7a7e6c243368165378e303e21b50eb37264561", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764664058, "uuid": "ebf1ffac-8637-46eb-81cb-62ae963e7d68", "comment": "Malware payload", "value": "4508b095f3fa7e032f6aeae243a1a4faa28f88c7", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764664058, "uuid": "dba24dc6-a50d-431f-87bd-57219ab2d93e", "comment": "Malware payload", "value": "25ade876c50de08043c789d3e4dc46d4f84b990e87a4ab75cd9a94eb588f5fccc358eca25749393b02769b25db1dea7f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764664058, "uuid": "673154f9-28f1-45cb-8088-3e9be50f7b3c", "value": "T122D33AE808106C12FEE6F4FB272A1581DE12E590B6C43769C251B27DF9072381E9D6FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764664058, "uuid": "f083a661-bde4-4429-9855-9eaf173ca942", "value": "3072:suXNHZqknjguHziOWiv+ApxFSqMZLuyMGFSdVfIE3q:suXfkuH++H8lQyMGUfI/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764664058, "uuid": "a47ac2fd-e38d-4f82-abb5-c6a35b09dff7", "value": 136205, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764664058, "uuid": "12822688-814d-47e2-8d6c-dc494b2720fd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764664058, "uuid": "09cbba92-2250-40ad-8859-3b3cc5ff3517", "value": "win11debloat-october-version-2025.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b700bbce-cfb6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764704410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764704410, "uuid": "7d82c3c2-525a-40c6-9fbe-12d71f682fe2", "comment": "Malware payload", "value": "2716c142f867a2d5f5359b788ccf3dac", "object_relation": "md5", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764704410, "uuid": "5dd19003-dd89-420f-a363-6f5d279c5559", "comment": "Malware payload", "value": "5e756ac5d10cf9cb83bc4fb12a5c62b880b6d35adf2d9489252b6e3e03c395a3", "object_relation": "sha256", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764704410, "uuid": "10aeaa6c-de81-4bd6-9e66-721e1416c606", "comment": "Malware payload", "value": "df542997904d23f05a8f60a67d0d6a78bc175885", "object_relation": "sha1", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764704410, "uuid": "960de2c6-e952-4795-b10c-72759097c58b", "comment": "Malware payload", "value": "7ce4de0c9a34d9ec258d42f4df8b4d4ad0e9a431084bbf1d3d82ed032de54718ed87601618825ef254935a7c4541d03c", "object_relation": "sha3-384", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764704410, "uuid": "aab2c8b3-1a18-488d-80fd-0bb7ddf302b2", "value": "T1A8A5330CCEBAA549F762D13D5F89CDCF82B8837053B048EB020D2151B65739899DE7AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764704410, "uuid": "379d5d29-254c-46fa-86c1-2ab69b58b03a", "value": "49152:MlWEJlU81AssNjTc8CifVOKySdSk6fz9SPkRxdLkKWrZjcLGTU:Mll86xQA8FVOKJdSH5SPkRvAHJcLGU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764704410, "uuid": "41ccfae9-7128-4af2-9bc1-67012f4e2a45", "value": 2176375, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764704410, "uuid": "8ef36d9a-7244-4ec0-babc-ab267cc53e91", "value": "application/x-lzh-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764704410, "uuid": "55169166-51e9-41a4-968e-36b54440cdd6", "value": "FIZET\u00c9S_MEGER\u0150S\u00cdT\u00c9S_TRANZAKCI\u00d3_BEFEJEZVE_62000078190.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08d2bdab-cf94-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764689515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689515, "uuid": "3900baf6-17ca-42c1-8566-1aa6118595b2", "comment": "Malware payload (Mirai)", "value": "d4f6a38576ffa2e1e5dd17abe61cb6d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689515, "uuid": "c1ebc6b8-74c3-45a1-8ea4-6e28c6885403", "comment": "Malware payload (Mirai)", "value": "5e8c4673ace4b163293911fe9dad7c231152f844f52e89ff565ca7ec698cef5d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689515, "uuid": "1f44818e-c788-4c9f-9b6b-1696ff4d166b", "comment": "Malware payload (Mirai)", "value": "7c995310b9ceaf486db91ca006ba9e8a9198e8a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689515, "uuid": "07660ade-b5d6-443c-9499-c5c1b52edb60", "comment": "Malware payload (Mirai)", "value": "39a7add721564c3fc6a09c4ddd02b41c1785242178a5e69c2aa61324eef13a8f73e5bc2563432923be85f23e25d97b3e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689515, "uuid": "a434b449-8ae0-4d12-b9a4-924da6adda01", "value": "T10E345CC7F802D9BDFC0BA676486F0A09B570B39104531A37A397FDA6ED3A0E25D12D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689515, "uuid": "32804ada-ece3-4e73-a50e-2e0de804410c", "value": "6144:dIj2RQUQmLROssSMSnCudj35fHkrLwUyf3Od30A3ghHI5kJClAXTBuq3y0/mmqDd:dNpuY3el/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764689515, "uuid": "64d546bb-475b-4f64-99c8-e878a217e0e1", "value": 251392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764689515, "uuid": "c1096a43-4f7b-493c-865a-b0ab0c8912c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689515, "uuid": "cd350dfc-966d-497c-84fe-ce96fcf09687", "value": "ecco.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4957c1be-cf5f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764666860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764666860, "uuid": "8c59dd09-6221-479d-bc1d-6ed60d28824d", "comment": "Malware payload (Mirai)", "value": "21580f3198dc19ea1ab5d8d1e1234999", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764666860, "uuid": "50ff98cf-4eca-4ab5-a92e-8c9619c9eb46", "comment": "Malware payload (Mirai)", "value": "5f7900a660251520754a364c5184fcaf36e16890a8c5923d330f16389371f3e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764666860, "uuid": "8afffeae-17d5-4ff6-b10b-84afeed68bae", "comment": "Malware payload (Mirai)", "value": "453d94f724b5221277e92785bb7bd07da8ac584e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764666860, "uuid": "1239e8bd-36c3-43e0-ac18-3ef3638792b5", "comment": "Malware payload (Mirai)", "value": "02264ab42b41e9be9c6cb6754a917e2126c97b06de429d578ab4d6c965667851f52846f65a7b4c18c03b7b0767606b68", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764666860, "uuid": "c2003efe-4b76-4267-addc-d382d22d4d76", "value": "T174430A93B950FE7EF40BE73E88C34735B230BA5645930622A36779665A373C4386AF05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764666860, "uuid": "54a47025-6853-4075-a0c8-31f458ccd148", "value": "768:rYuIng5ZKa/x6vJ9fll9OBB8eZqvanvFxB7vJXdW3O59yAwRAudw:rYng5b4dHMB8eZ3nvFxtvJsOadw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764666860, "uuid": "fd0361b9-364a-4646-9f90-8a4a09b732b6", "value": 55818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764666860, "uuid": "6dc2e160-fded-40e8-b564-6cc193839874", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764666860, "uuid": "f7891f52-7e82-4193-a6c7-fff1cc656e24", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90822f35-cf5b-11f0-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1764665262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665262, "uuid": "3776fc40-7c8a-47ae-8f2e-46e960eedad2", "comment": "Malware payload (SnakeKeylogger)", "value": "e1911695e0efb5c0d2fef3bbbe79be44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665262, "uuid": "478b668b-4e5a-453b-bfc7-eaf2cf65f90c", "comment": "Malware payload (SnakeKeylogger)", "value": "60203c6af96861965a089eb2c9aa70ffca1a5dfee35a369e77ad3f17896a8ce3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665262, "uuid": "4bf62816-c0bc-4ec0-a293-33abebb19769", "comment": "Malware payload (SnakeKeylogger)", "value": "74b0658c5b7b85bcae31d4090a6b64893b98dada", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665262, "uuid": "670cd67c-a575-428b-8f97-fda1b7dfbe68", "comment": "Malware payload (SnakeKeylogger)", "value": "0bf625b4e680929afd63b26d2f58cc51a7ef19df16309cf0e30d83d0fd0b02a767846498b3f2ae346845dc71fb20e123", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665262, "uuid": "36d2782d-5616-469f-81f0-a165391ec54f", "value": "T107B412A81229DA03EDA167F215B1E338E7B15F6EA522CA2787DECDFFB4417544840393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665262, "uuid": "406394d7-c012-45fe-b26f-8252663f0286", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665262, "uuid": "9924221a-f396-4999-bcaa-84883a264edb", "value": "12288:sFMIU4iOtmjqb+qdVyZBil/tfqPFAtS4gkR:EdtxbfdcBstSNwSW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764665262, "uuid": "2e6e7b1e-34fd-42c1-ac47-dcd635b731f7", "value": 525320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764665262, "uuid": "2b14c116-35f3-4457-aa20-cfa568fcf679", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665262, "uuid": "c9d4e821-0e26-4c11-b165-3b9ec957dcd1", "value": "NEW SHIPMENT INFORMATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac5e7089-cfa3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764696232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696232, "uuid": "b805432b-d3b3-451b-9de7-eb9d368cddf8", "comment": "Malware payload (Mirai)", "value": "b5a4791f2a07d6f37ea17b454a9ea771", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696232, "uuid": "04f2bd74-8754-465f-a7bf-2841619d18fd", "comment": "Malware payload (Mirai)", "value": "60e42b6ea58e9b3809ae23a3c79b068b0fa26805e445275486ec357e29412bfe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696232, "uuid": "b581acdc-9186-44c8-b7e9-061960d8a79e", "comment": "Malware payload (Mirai)", "value": "fcbca3ef3be70516091d4d02edf019e76f977b0a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696232, "uuid": "82a4ec04-c211-4d75-9fc1-f85c544c3383", "comment": "Malware payload (Mirai)", "value": "e6981692114e14ca27ddc4f024fb124be40ae8519e31d99a1031130dfb78f2ecaeeba3b7f8410b50cdb19ac9432f5f38", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696232, "uuid": "4bf37ad6-f13d-48e7-b2fb-81b91dbb830c", "value": "T11004A71E6E228F6DF668873047B74A25976D23D627E1D684E1ACC2101F2039E645FFF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696232, "uuid": "d8aa3c16-7a9c-41fc-9514-538482bce6bb", "value": "3072:0V0HwGMauZzH8ak3n8Uftlt6p8f1EqbnYHBxCAxZg:0V0QGZg8ainlQpGEpHBEAxO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764696232, "uuid": "82726dd0-8f3c-40c7-a7c0-7002af0105d9", "value": 190024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764696232, "uuid": "957c7524-0341-4447-992a-1419c9cd12a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696232, "uuid": "8beccdd8-8af2-4845-8bb6-d5c3359491a7", "value": "nshmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4418e66c-cf50-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764660409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764660409, "uuid": "5eddbe0f-c1e8-47cc-9abb-8955bc0f6ba0", "comment": "Malware payload", "value": "005fefc1d4151631c272780afdfcad4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764660409, "uuid": "e6363220-2902-4ea7-bb43-58da3aa75214", "comment": "Malware payload", "value": "61155ab70f260a84792d08c16c5e20404f26c9a1996b66308c6ac305eb690d34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764660409, "uuid": "538d546c-bc3b-4939-bad0-be9bb275427d", "comment": "Malware payload", "value": "36eb5b8bb0692dbd332c484d5e5bea9efd340fa1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764660409, "uuid": "82e1b899-06c9-4071-9184-50518d813328", "comment": "Malware payload", "value": "e2d55e4fdefa5d448116eabea723a0348243e9fd61fbe1fc20150a181e8cb36442c99ea17700b3726a5f6216b1df7232", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764660409, "uuid": "971abf8e-243f-42be-a09b-96fbc7f19107", "value": "T149463A07FC9945E9C0AED2348A729252BA717C491B3127D73B60F7382F76BD0AA79740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764660409, "uuid": "e96aa166-2185-4a45-9842-f29ebbb5444c", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764660409, "uuid": "5b5b04ec-b20a-4463-9e30-3aff80aefe93", "value": "49152:/zH47bwWOYCWkJ6JrC/7hQNXZWpkmNPXnVeLXgtjB5EVr6CTXj3TaOJ+P1:7ocW0GC/7hVkEtwoEpzDaD9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764660409, "uuid": "dcc79de7-02d2-4766-ad16-10180624de1c", "value": 5405696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764660409, "uuid": "e5e11d92-95ad-45ac-b43d-5a18f258fe8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764660409, "uuid": "b4efe84d-dc2f-4e28-b3c5-0f70b4a882ff", "value": "agent6000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19b30e89-cfa4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764696416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696416, "uuid": "23454045-adb7-4009-99b9-5faf09aa2092", "comment": "Malware payload (Mirai)", "value": "a0a281cf5e8d88c5b62943d0b80c51ef", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696416, "uuid": "636d3627-2a19-445b-80c6-a38b59d4931f", "comment": "Malware payload (Mirai)", "value": "6174f7d79e48448d38278254374a2d30a7c2880f7d055b8a8484c2fe00cb277d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696416, "uuid": "eacf96db-f6af-497e-b2a6-5f1604970d5f", "comment": "Malware payload (Mirai)", "value": "f0c39ecb90f915f32fb1aefba3d2895f474db536", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696416, "uuid": "828100f0-6c03-4779-87e9-050f70f710ee", "comment": "Malware payload (Mirai)", "value": "925c111912e1cfe04317b07f58f07568b2c1cc869d0702eeb6ceecc82e39b9418ff1ef8b02fa276cff9c450a299f5537", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696416, "uuid": "0f298b60-7118-49ee-b3bc-230fe22f80a3", "value": "T1E25130C6B3824831EFB65E9A75B48404B184E0666FD2DE46E4FCB8AD8C4FF086491A57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696416, "uuid": "f6aa4f09-1c9a-4a3a-a73f-493c5a7cb2d9", "value": "24:vuOSJaIOSXOSdOS/OSATtkaUoOSJoOS/OSqvOS1OSROSBaXg9OSKOSUCOl:vuRlRXRdR/RUfRJoR/RER1RRRYoRKRFe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764696416, "uuid": "e6e48116-f562-4820-96ee-a299128c9c60", "value": 2695, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764696416, "uuid": "2d354394-6613-4833-a25c-5bbe14719bb8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696416, "uuid": "8ac08765-4e94-4914-825d-ccf514bd71d8", "value": "yarn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "701279c5-cf3c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764651893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764651893, "uuid": "7b950d46-525c-4826-890d-53c273f4a07e", "comment": "Malware payload (Mirai)", "value": "57c4c8f76b751637b6712ea09f803a27", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764651893, "uuid": "2bcb8795-0cb1-4689-80da-56442097c3c2", "comment": "Malware payload (Mirai)", "value": "6312da3b8ac7f1467b013cbbcef9ce875515cea7c061c08318d27a8fb35689ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764651893, "uuid": "b0bd039f-bb4a-4fa5-9da3-f57cd91c7181", "comment": "Malware payload (Mirai)", "value": "e600a634cfe49e718d1dacb97248d4088928f624", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764651893, "uuid": "b35a4ab2-b5d5-4745-9e65-a994e5c8e3b2", "comment": "Malware payload (Mirai)", "value": "518a205c7b35d5c6ec8bc693494971a1b444447a756341b06cded5d7f20b5f464bfea37a3fbb32d8f6846b1560869944", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764651893, "uuid": "08420359-82cd-48df-aa11-a054c8629f28", "value": "T165F46C06FF506FEBC06DCE7049AEC216009DA5D245D5A32933BCC78CFA5966D0BD3A98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764651893, "uuid": "f92e3244-60cf-4854-9e8a-b44d2fe29e61", "value": "12288:JLRwJqcsRYiZeZiSrjXMG/mtAbzboJqeO9FlO2G3FtmfxrIqPOYKPVKNjLutwW0Z:dMxxPzAgjIqArhljO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764651893, "uuid": "a6429a50-05ed-4d67-903e-13856e2bed4d", "value": 722872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764651893, "uuid": "c0ed7b56-4275-4060-9bf1-dffe7e02a60a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764651893, "uuid": "ba236f98-2058-478f-a662-b1f0032e46be", "value": "sync.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "852984c4-cf60-11f0-a129-42010a9c0007", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1764667390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764667390, "uuid": "99122e3e-6a95-406d-ba30-d607ba02cb61", "comment": "Malware payload (VIPKeylogger)", "value": "f901169bcd4903c6a0a90a0fc120d5f7", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764667390, "uuid": "eb4d61fb-e0cc-4070-9e30-96f1817f61b3", "comment": "Malware payload (VIPKeylogger)", "value": "634d00db157d24723b2b193b826f178b6693403ba06dbd0e557d42dfea7e9a34", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764667390, "uuid": "423b4b52-c516-4b6d-bd51-290f61c4190f", "comment": "Malware payload (VIPKeylogger)", "value": "f02d18bfd9f096a723677f59619962a38eb2109a", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764667390, "uuid": "31adc8e0-f960-4975-8f6e-3411c6ae33e9", "comment": "Malware payload (VIPKeylogger)", "value": "4054087c7f21c062527655d699036370ce52f5405354b8a4b25101f7a96b66145c5b2284d58a5e4daff609f7a7c1d0c1", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764667390, "uuid": "f8ae5c4d-9bf3-41f3-a28b-ba64681a4c6a", "value": "T198F423BAC7B66ACC58E525E07F4C4037B739749D68D4B3AB43C352299C0AF8A026D743", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764667390, "uuid": "a5020cee-cacd-4fd1-9c18-42f4b9e3d7fd", "value": "12288:B+B3m/Om47thsdwjxBN1nv1iV4/wYGBvVdZZ9bn7p5ZUlEo4mp52Rkx:63oOntWSjjNmVkwYIVDPbzeEon2ex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764667390, "uuid": "93ec9883-d19f-4744-a8a0-aab293b61773", "value": 725551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764667390, "uuid": "57753409-7e5a-483d-aefb-744703c590bb", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764667390, "uuid": "6668c663-40a0-4be2-ad0e-e21db616d531", "value": "Malware untuk tugas.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c656275-cf40-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764653658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764653658, "uuid": "072ef552-7423-41f4-adef-a01e6d919f00", "comment": "Malware payload (Mirai)", "value": "e819411cebd84463c569d2461074021c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764653658, "uuid": "171f6012-e5fb-44b0-a5bf-2288a2840372", "comment": "Malware payload (Mirai)", "value": "63ce6d294f3c858eab9e0a6e0fc37d58412a21611919605b87421c1b84fb0862", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764653658, "uuid": "6576b101-d7c8-45fa-8d6e-ffa399c9478c", "comment": "Malware payload (Mirai)", "value": "1f628178c07b4ef150929ad041b3667256191d5f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764653658, "uuid": "9f57fbe0-9ecd-4de1-88c4-06a2e095dc8e", "comment": "Malware payload (Mirai)", "value": "908cba73d71467994c698ab36ea58048d8a5ecb26fba3ec611be285623d7e01ca4c5f6acc0c33c3397569eaa20d4b955", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764653658, "uuid": "8091a98a-111d-4bcc-8ce4-7524e5d92f74", "value": "T1AA5191C817C640B4ACA65D766BB44A45B6986097FCD13FFC68E938F8808EF5E24C1B47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764653658, "uuid": "34f9e4f5-5a8b-4776-a54e-5be71c1faa59", "value": "24:ItpHSm6W4pjeHeQDG6x7Kg+qTp2FE0wKNg1eo:ipHS2wSG67KP82C0wKNg1R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764653658, "uuid": "0757e86b-8678-4a02-a241-3bfcc0299804", "value": 2779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764653658, "uuid": "1e8822b2-5f8b-4322-a149-af3e3905bf06", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764653658, "uuid": "f5fe8a2b-ecf0-48dd-8795-3070c80cb480", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa5a73f5-cf48-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764657145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657145, "uuid": "d4c290eb-86cb-45b1-9812-2f75072fe919", "comment": "Malware payload (Mirai)", "value": "e1659b5dc4adc3d69cf4f7898823062f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657145, "uuid": "9293d447-8439-40bd-b1ce-d83d0140c1f7", "comment": "Malware payload (Mirai)", "value": "65d856a212dbd8b37c732c7669b36887a9fa058e876ded794481f571a6fbda1d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657145, "uuid": "2d26c4dd-0707-4502-bd02-b976d68b64ae", "comment": "Malware payload (Mirai)", "value": "e1c5bff0d67d7d46209b02010af12756d23cf15c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657145, "uuid": "0b9bfd01-9ae0-48a1-8718-14766c552741", "comment": "Malware payload (Mirai)", "value": "fdef3d04e3ee185b5f63d5c90b3b481c53cf63d2e81b4a1d5bdcb7274b5587cd245e2103a90f070aff7b97bf91ce0ec9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657145, "uuid": "43fe7660-a3bc-4f20-af64-9cbbdae8d76a", "value": "T1C5A3175AF880CA16C7E427BAFB9E058C33221778D3DE7105DE148F3167DBA1A0E7A915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657145, "uuid": "6de4fbf3-a715-41b7-847d-744747a6eeb9", "value": "3072:W4qZur3uYmr2aTAFXFCjusuGMaIQb3zII3oP:W4qaRaQC6GMaIQDzFo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764657145, "uuid": "a8f0f42e-f9cb-4632-8588-0adee2d4bf95", "value": 99636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764657145, "uuid": "32e5df07-d3c0-4ed5-8fc9-f3fb994dc619", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657145, "uuid": "9a28ac25-7f97-421f-86c5-8e3d6a8c8d87", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eac8a8a9-cfca-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764713087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764713087, "uuid": "20bc85fa-1858-437f-b2e2-dbd02c522aff", "comment": "Malware payload", "value": "a08c5b9485a34634e912b704759d5b4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764713087, "uuid": "ed06d620-b4b4-4e75-9101-aec5c5142d17", "comment": "Malware payload", "value": "6684bd671de9dce1e8cfc4d41bf5a4ef3dabc8925eac4a47712b128224518b9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764713087, "uuid": "f4f4cb3a-4e42-4fb2-9657-761ca8644028", "comment": "Malware payload", "value": "04115db04e640bbdc72c0e541d401c7aed1263a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764713087, "uuid": "d8546769-c0d0-42c3-a255-68132fd2264b", "comment": "Malware payload", "value": "240db5856253a6dc25fb4869d01b0e2794b357531caa906c20bc7a12de9f2e1778f1c788fef6644dc635e9aa551e7948", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764713087, "uuid": "93d9d62f-07c4-48d6-be8a-aab4c1d2e6ee", "value": "T126963357B6AC03EEF9A68239B5708471C26ABF170B11C597B2E4DD6E0D232CC56363D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764713087, "uuid": "be438f96-a248-4bf0-8848-b32e28913cab", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764713087, "uuid": "cbacf48f-ad2e-4144-8ede-b52030b6ba1c", "value": "196608:ICugl7W2urHmoFP/XRL94GG2NTsj+lOnO/:ICu32uCAXH4GZ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764713087, "uuid": "afd0584e-4ab4-4975-8d91-f59ffe571c74", "value": 8788832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764713087, "uuid": "083de8f7-0c39-421f-9051-ba62c9be482b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764713087, "uuid": "007e94e0-bd4a-4ba3-8e20-dcb616ee5f26", "value": "Rateconfirmation_1689345.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eaa7ddb-cfbe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764707752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764707752, "uuid": "d933fa71-559c-4904-8f3b-0c5bc874c29e", "comment": "Malware payload", "value": "6ed7f8c497f0446b85134dae3a6f3ea1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764707752, "uuid": "78d2e2a7-8a8d-4352-a989-480f0c93402b", "comment": "Malware payload", "value": "686b360fdd97639fecffb992ba975cd637ebdd70a941278cdcf9cbad602fee5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764707752, "uuid": "6f44a850-d041-470a-bdbd-15bad3f57c1d", "comment": "Malware payload", "value": "23c2f3326a953f50f9e8ed452ebb04fead633b45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764707752, "uuid": "cd6bd726-1ed4-4e56-82b9-380432ed40cd", "comment": "Malware payload", "value": "810552838e434107e311ac4aec09619201ecd0438c3c8c227aabddd6030fe9cc909ebc236263f561b997040ac3a3f2c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764707752, "uuid": "4a62209b-bd71-4527-980d-ec81c8bee369", "value": "T12D370107F1D251EAD069C1759BABD732BA31B88D8F326ADF164057212E53ED01B3DBA0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764707752, "uuid": "6a4adbb4-855c-4d50-8a61-0192eabbdef9", "value": "1c7a490216124b1bc98bf9c2b898abdd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764707752, "uuid": "3977b0a7-9d15-4586-a95b-31184f586a73", "value": "393216:qvvbtB0N+DMzYwLe9fDDd4B8aa512okUk7ILxmRXKzYb0N7bPIPKD/bfH2nMWL1:nID+V02GkMLxmEzg0NHlD7y3L1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764707752, "uuid": "1878210b-af1d-4351-978b-87c49f4b8922", "value": 23037952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764707752, "uuid": "a2d301f4-a6f3-4ae8-980b-4d0a87e9722e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764707752, "uuid": "b6572d18-c01c-4e4f-bbba-e8a95acdb3ad", "value": "letsvpn-latest-SetupX64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "904cdec2-cf60-11f0-a129-42010a9c0007", "comment": "Malware payload (Gamaredon)", "timestamp": 1764667409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764667409, "uuid": "aacdc20e-ca37-4a99-a4e7-fca8f4ffd7d2", "comment": "Malware payload (Gamaredon)", "value": "a8a5fa5279f88f0102e51659b2f0b204", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "GamaWiper", "colour": "#90C3F8", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764667409, "uuid": "ef7993a9-2c51-4489-9312-fc6f778d99f1", "comment": "Malware payload (Gamaredon)", "value": "68e21d7599d20444232415a7e74214ce50d7b4643215d83b8320e74c95a9dfd3", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "GamaWiper", "colour": "#90C3F8", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764667409, "uuid": "efdce0c6-8bab-4ffe-8d8e-f6bc4f9b50ea", "comment": "Malware payload (Gamaredon)", "value": "8dee18c21af68f230262e69de4b90d2fd2ca3cf6", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "GamaWiper", "colour": "#90C3F8", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764667409, "uuid": "fa902186-dda2-46da-bf3e-3c6332c75e8b", "comment": "Malware payload (Gamaredon)", "value": "6275a9b1a55870ff2e9d4b01910b33b4e773c816237a3c933c759b83cffd90b04621d756daeb621e0a5ef969e9667bb9", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "GamaWiper", "colour": "#90C3F8", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764667409, "uuid": "9b29473c-72a3-4529-ade8-8f50c33bd16e", "value": "T1D3A34C1BB8432295C72A65C7C687328BCEE564783A3214D1F1358CA71617CB9EB8ED3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764667409, "uuid": "ffd03dda-eaa7-44a0-a93d-3dcf7b170d87", "value": "3072:Q/8mVNSifYnys8pNbUs2QqD5DTOhUnfpiU70C+2O0r:SFppNbbqVfOh6iUxTHr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764667409, "uuid": "87a376e7-2944-4378-bdfd-ceb2cc8a30d5", "value": 104053, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764667409, "uuid": "37220fc2-61f2-4014-b081-b988a25f33e7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764667409, "uuid": "88bf3d76-3ed3-4833-a996-03a842211894", "value": "rufflerab.vba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4bf2e54-cf5b-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1764665403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665403, "uuid": "5e787d91-d305-4fa3-b5ff-ca969acbf233", "comment": "Malware payload (Formbook)", "value": "35ecf5e29556e566664ec7aec3a13e2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665403, "uuid": "694b8b47-9246-4ed5-91b6-70a04a65b8ad", "comment": "Malware payload (Formbook)", "value": "6ac566e9a69e4bd338cfa6665c04a954c891fc5c09698ae85a40d9565796f481", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665403, "uuid": "28ad2bb2-c0ee-4cf2-b0e6-26647abe1833", "comment": "Malware payload (Formbook)", "value": "499c60519ebb622e7736e5035bcdca7bf404905b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665403, "uuid": "818eb44d-c026-4cf0-9d51-c74af2bbe5b9", "comment": "Malware payload (Formbook)", "value": "223e5e0ee882f787a1523a509655a5c120fa2f6aa7194fe9f42230408c7382ec1cc663ca110eeac665c2e66257d90e12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665403, "uuid": "bd256702-025c-41e5-bacf-f11cf35e68a3", "value": "T191F402479E88DA13F4A153FA6D73CA7827662E4DE021E79E4BEB4CCB78503124DCC265", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665403, "uuid": "5d56b028-1856-441a-bebd-5e0d0f8aa7ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665403, "uuid": "b8647cf0-6acf-4adc-9e9c-3e1b64accb3f", "value": "12288:u57Pa3viM5ikbW1i/nANnq7/NdNPFk5B38vWsZi6c9xHC:Ua/B5iWVnAYFdMP38vWsZiJDC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764665403, "uuid": "e71c718e-836e-42af-85f0-04a3e04d17be", "value": 757760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764665403, "uuid": "0c7aff86-d2e8-4c16-aff5-5fba3fd5f3f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665403, "uuid": "1b1f7904-5bab-4a24-b6ba-3afc77de0ddd", "value": "G0zICT7BrvSkguq.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "958b69bd-cf2f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764646372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646372, "uuid": "896f4fbd-a390-4cf0-9331-a2171b700fef", "comment": "Malware payload (Mirai)", "value": "305e17e1132de04d7d1f5ee96f80364d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646372, "uuid": "69f0fb49-d775-4cc8-b1e0-9455da1083f5", "comment": "Malware payload (Mirai)", "value": "6b00683cf11627a703f9d3b31cdd14190dc9759e2dde35fa52da6faf2eaf3630", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646372, "uuid": "dfe4076b-27a7-4d8f-aabe-c5762c0abdd8", "comment": "Malware payload (Mirai)", "value": "a0f53a559efccac1f1c8ba107ab10bbca8efdc0c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646372, "uuid": "a6e3c644-7ba5-45fc-83fb-a5536387036c", "comment": "Malware payload (Mirai)", "value": "4a73de41739d40508ae952374dde78ca204fc9eabd15666bc340ca1173c2046aebb4ef05c702a3d9a4594e696aee7994", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646372, "uuid": "c5c868e6-ef29-41fa-9882-a80c0589b3a6", "value": "T1EE23E8C17891AA39C3D063BBEE6F018D3355A798D1DB3397C8241B947ACA90F0D57B4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646372, "uuid": "b8518546-b7c6-47da-b068-7afd8f50559c", "value": "768:uvgjOglXo8aCFUvFbBB7Q4EnJdd3C0H0eCSJ1Wml+/DjU/jFLwCVy/Jx+5H8hG1T:nSgW+Fywddl1l+/DjUbBeZWm226U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764646372, "uuid": "a31dc5ee-0bb9-4947-82cc-31eeb2f7f58e", "value": 48168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764646372, "uuid": "8040ddd8-a753-48c7-a1af-5277e9577d23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646372, "uuid": "ec5319c0-446f-4fbd-9d3a-d9984bb0af04", "value": "3atoNational.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9dec8a5-cfc4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764710482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764710482, "uuid": "8584fe13-8a80-4dff-b6b4-d354a5c1b63d", "comment": "Malware payload", "value": "6d22e2a3afa9981f2e9e6a62ee43a6d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764710482, "uuid": "7f90a99f-e76e-4a0d-b874-ed14dd163ba8", "comment": "Malware payload", "value": "6b1251fb7b4f9458922c94f0abd0584fd891860ec12fee5da428b7b6dc1136f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764710482, "uuid": "64d9d7cb-9b0b-4e00-a0ea-1739334c566e", "comment": "Malware payload", "value": "319ac60135ce00d4c30b9ea3515d2833c560dd8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764710482, "uuid": "f7b6d8a5-0357-4240-9fa4-219eff0fc6e4", "comment": "Malware payload", "value": "1285d92a369ce3a4fadbd378eba4702283be5c8c6606a30b688d795e1ba13b2173474c4dac1386cb8222c7371a66a1cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764710482, "uuid": "c207ae3f-69ff-4006-8270-ad40b9d72377", "value": "T1E5434AAFA68341BCC617C53849FA87B2F873FC621531A93E2298DB721F21F504B5D225", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764710482, "uuid": "38712534-2690-4244-b158-fa17f4f4cfd9", "value": "73ae4f3451c1072e4b0cea100cb552bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764710482, "uuid": "ea3d3ae1-4caa-437f-8c36-d301d32ff2dc", "value": "768:JlDdO1ccLlJIgGSE2UmPt05qtG2bIbO6wJPpG+MbxxKT2lq4FfK:LDdOmyJ3VEm0MzbsX4IG2lq4FfK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764710482, "uuid": "e5ee32d5-8495-48c0-88a6-47714a31915c", "value": 56336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764710482, "uuid": "be621442-e818-453b-ba2a-aca237e47198", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764710482, "uuid": "ab18f580-51b2-4c24-ab7f-68a5a7f2bbf1", "value": "MSTeamsSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74f6feba-cf3c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764651901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764651901, "uuid": "a3e39d22-78c9-4b27-9dc3-29a8f07e198d", "comment": "Malware payload (Mirai)", "value": "9ff87a4951f5d078097486f92534963b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764651901, "uuid": "cb035446-5c1a-4d73-a047-c46747dc097d", "comment": "Malware payload (Mirai)", "value": "6b2c6b76e0d75e311c9f2c94d197c9f7cb3a7dd15792024e7420beb50739bd21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764651901, "uuid": "efe45afa-9721-4777-98e1-d465c06688b7", "comment": "Malware payload (Mirai)", "value": "4004e24324d2e135c794b5116cc712bfef379c3d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764651901, "uuid": "d13bd6a8-b478-45b4-852d-9097c2e2bb43", "comment": "Malware payload (Mirai)", "value": "2a05d31bf898eb10430b9fcb12ed9a2d0a5ab75d9e0cf9ae9ba7555956c11d9fabc0f08ec0bb1bb3066514a54fc9f5a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764651901, "uuid": "d0fee569-d580-4622-8ba1-4b67070ed762", "value": "T18B130220E5775D9BCE7F7F206CD126F57BE902C9171DA8936383EA1067A249A4242EC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764651901, "uuid": "f4e3f920-5754-4ad5-8c3d-ee95aed7ad90", "value": "768:LSh5uIupf5wqlJgsS4K8GwyYJgkg1rCLc/QYLqdBmloO8puy6Cudn03G9Udmkzbn:LUuIaf5hAsTKYFbLc/N0gQqxnKGCL4un", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764651901, "uuid": "bc9339ad-e13c-4a31-bd06-f59cf0d7d427", "value": 41492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764651901, "uuid": "407b63f6-6043-49c0-b231-f5f0eebecadc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764651901, "uuid": "37b91d87-d439-4630-bda9-9b224d772668", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beae4f56-cf50-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1764660615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764660615, "uuid": "0d5e44b4-9d93-44db-bfcc-cf0edcb0965d", "comment": "Malware payload (RemcosRAT)", "value": "6dd6d93f4fc6acf6eeea7a98e12bc405", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764660615, "uuid": "fbd7ac6d-8aca-4907-936a-5b53bed956d9", "comment": "Malware payload (RemcosRAT)", "value": "6e57966b5fd6c676b5be0e7ff8d713053722fbc27723768ab7b5e96f1157ae91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764660615, "uuid": "fb44c102-a83f-4096-86d8-28e3c925d499", "comment": "Malware payload (RemcosRAT)", "value": "b9008ca949b78a24679e16818ce81dc40c72b230", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764660615, "uuid": "0cede7d4-aadf-4749-8074-2cbacbd5b368", "comment": "Malware payload (RemcosRAT)", "value": "363802828640be1947305eb7bf40909877b2aec7a6fc3555ef7c11dd9064fcdffbf5bf9fd45566a7b0fdf35b5f17269d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764660615, "uuid": "63b32b1d-a6ab-479e-8e6b-6562c388b0d2", "value": "T157358B66517CF40EC6F4EA3CE5909126029BAD8D1C1CB02D89A47F6E76B5F9C0A03F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764660615, "uuid": "fe117fcc-a313-4c59-882e-4ad0f57e6197", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764660615, "uuid": "2849fc57-b112-4801-870e-ce83e98387ab", "value": "24576:591rv9d5GdiNEtIlye94TM5W47TE6kDlsYC+UDXaD:5vVtmtIlyeBW4/c2YC3mD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764660615, "uuid": "c95e620f-1e1c-4158-acd3-b58f7479e695", "value": 1146368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764660615, "uuid": "ffc1ec8e-1728-49f1-ace0-db64b2ffcc14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764660615, "uuid": "c90172fb-76b0-490f-9f15-034422c28a10", "value": "QV71QtGdISBfJXV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e128853-cfab-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764699429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764699429, "uuid": "19a7a9ef-79e3-4e31-b61f-77a32be243d2", "comment": "Malware payload", "value": "b83765324d711f945e42871d35c991f2", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764699429, "uuid": "82b2f1ea-8a92-409f-8a02-f613b693306b", "comment": "Malware payload", "value": "6f1e5deea29ea4ed7877b4194740a861cb933a24ec58885ea85a41c807deea91", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764699429, "uuid": "e071cb5f-9522-4409-907f-29fedf7483fe", "comment": "Malware payload", "value": "ed505d64e442ad73740fdf513d76ed3fc892f933", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764699429, "uuid": "08e11e02-7f28-423b-95cb-599f50507b1e", "comment": "Malware payload", "value": "3c6ad755c12ddd24ef9891fc5291bc7b7c02c5cb1ed5624371718c7ff6bc11247a3f46d1ab0add87912d9158cf0dee55", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764699429, "uuid": "6abf9958-9120-4eae-a0a7-aa62694783d6", "value": "T1C3852308248CF656E9A54FB16D74C0B13F38BED9FE20E50BDBE53E9FB9A16508904613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764699429, "uuid": "eb624950-1741-41b9-afe2-3668f5c2c863", "value": "49152:brkRqRS9ViWRs91rDn5OU6lbdhhWeL0onoRVP:bARimVZs91rD5OZl4M05d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764699429, "uuid": "df42c054-c1d7-4317-8084-873218bf6008", "value": 1760768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764699429, "uuid": "9bf2ee08-2f2d-41f7-9102-ffa3158915ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764699429, "uuid": "5ed5e227-cba6-49ba-b32c-78d3729e73b5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12cc53ce-cf49-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764657320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657320, "uuid": "fb8ee439-bdad-4869-950d-da6f8f31adb5", "comment": "Malware payload (Mirai)", "value": "5dd6a9f7c8da669deac827d4a973845d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657320, "uuid": "a5673805-0d69-425b-896b-4f741b53e438", "comment": "Malware payload (Mirai)", "value": "7106277b0bd86c68e735625ac840570342696ad01326a42ec3ecd34927cc9f3f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657320, "uuid": "4338969c-42bf-408d-9051-db0caa023e1e", "comment": "Malware payload (Mirai)", "value": "d54ca3e914d4ea81c3ee36c933ea2ce7a1674302", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657320, "uuid": "aae1d44d-748a-4d4a-8e3b-b7c763cab2f0", "comment": "Malware payload (Mirai)", "value": "175ed0e72258368b1563ef80abc5d23d8faa3d69b07cafaacc5b58deb36aa8015d3afb4e8c335e41434bdd0d0b43e474", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657320, "uuid": "4d7f9690-9d08-426e-b3ae-7b6e921b3a40", "value": "T162F05CCD81B2DC3158934CEBB1369619ACC6C5CA0B878EC074CD007FE0CCD0470A2D95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657320, "uuid": "447b5b34-2111-4f06-9db8-02055221caaa", "value": "6:ebw73w5/KDbA4PZ9wWLZA9shGo94RNAcs2rFLf+03B0bUeEnuXSIy1bmhS:3WKDbnPZ95ZMoOF7+MB0LEYSIy1KhS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764657320, "uuid": "0a6a91ec-6ac6-40af-b665-295cedf92e37", "value": 458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764657320, "uuid": "b75c4dcd-089c-45da-ad24-e3049498d2f6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657320, "uuid": "098e2fb9-ea70-4e99-b22a-a89cbb5ab66b", "value": "k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f94ffa94-cf89-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764685194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764685194, "uuid": "808e4d42-feec-458e-849e-2dd18c6c5020", "comment": "Malware payload", "value": "5a6ba40b4a88291c9c2a6b20773671c4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764685194, "uuid": "3edd61b3-6281-4429-9def-32dc03320415", "comment": "Malware payload", "value": "711872f50f858e4094a8525f75ba907827037d3dc1af16fe01fde0cd640db120", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764685194, "uuid": "09619829-e8cd-4464-8884-e9257104a50b", "comment": "Malware payload", "value": "c0dba41bb1541bbc7b0974a57d64f47f4805d571", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764685194, "uuid": "ac865d73-2e56-4c91-b072-cd8236666cdd", "comment": "Malware payload", "value": "4fb3c68bd0bbdab75d1079f7ca59ffe1f0a51af2bc6ebd14e04f6127ffe2ee3cbc1dd5950a097ceb0ff79b30c223a215", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764685194, "uuid": "10dc22d1-230d-49df-b49b-d2c72b4da674", "value": "T1EA1500D407A9D265C5B51B04CF004385AC59932E9B06E1A93C2D84DBDF25A7C26BCCB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764685194, "uuid": "ae4558ab-3820-4977-ba83-8c5d2995e4cf", "value": "48:z8tPFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFb:wb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764685194, "uuid": "bf5e3fc4-0f4e-4b76-9d9e-b51c343928a6", "value": 903390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764685194, "uuid": "d5bc1bdc-64d7-440b-955f-71f9bf1c8f6d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764685194, "uuid": "eb0c5947-6543-4bde-be39-02033a300679", "value": "Purchase Inquiry - SIMSCO251201-122.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87204f52-cf5b-11f0-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1764665246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665246, "uuid": "10090852-e1bf-4d34-81b2-307de9d06c78", "comment": "Malware payload (GuLoader)", "value": "dba2d029dd1f2e9969036411c5e136c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665246, "uuid": "ca421fb6-2e04-4c0f-b521-3216b36dbcf5", "comment": "Malware payload (GuLoader)", "value": "7152fc2a8c08211d57c454dac030af4acf0222e8564463cb60b036d0cbd424c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665246, "uuid": "caa771b7-f042-4e89-9180-6e45765fe88a", "comment": "Malware payload (GuLoader)", "value": "469ea7a573f7fc6b72f91340353856924fff064d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665246, "uuid": "f48db609-e304-410e-8a48-685ac2cf7f10", "comment": "Malware payload (GuLoader)", "value": "42712e71561aef35476d5d7e0b20739fa5634e8c1f5b70ce33fde6fce8be094d2cd4f3370a7e85bb3b7490e02e836315", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665246, "uuid": "0b196aea-9adf-429c-8503-2921fbe65beb", "value": "T15DA4E003FB49DC2FD167263A1895671E32A8DE059A173B0737647BD8E432A956EC83C8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665246, "uuid": "66462751-a244-4794-bab2-7e636eae6316", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665246, "uuid": "cd48dbc2-bbbd-4319-b242-eb011d602588", "value": "6144:3p+ggKWMNFaP6B0UX38LN1jMST8BFJ8xpylY0p2mRpczVQnjx5g9pZ:ZBF3lX38LN1rABFSxMlBqeg9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764665246, "uuid": "57c7b173-91e9-4ec7-b307-b59ca839e152", "value": 456072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764665246, "uuid": "646dcbc4-40d5-4521-9103-b1ce91f18b7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665246, "uuid": "4b3aa4f2-fff4-449d-8c5a-5aed08fae65c", "value": "JUSTIFICANTE DE TRANSFERENCIA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d1e662b-cf71-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764674490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764674490, "uuid": "303367f7-8926-4b56-bfba-a213ecdb353d", "comment": "Malware payload (Mirai)", "value": "3270429a8115e64784a919114f12f931", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764674490, "uuid": "00f754eb-0d0e-48b0-8712-fc330e6ae508", "comment": "Malware payload (Mirai)", "value": "7193e0c4b1545bb5f9c4306ec71d7764c364f5c0e4d7c67def1e7ca966e2178d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764674490, "uuid": "3481a272-7bd8-4dc4-a975-41dc86dc1b36", "comment": "Malware payload (Mirai)", "value": "a55793336bf2a00dce4eb2e7e4895505a74701a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764674490, "uuid": "350ef3ca-dc66-4042-9ea3-87c55c0826ad", "comment": "Malware payload (Mirai)", "value": "f30c819b221a16d57776e3dff83a259de19e1890bce8bde94f6b991e2ca4675800a8bfe6043df551e4783e66d9a11b37", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764674490, "uuid": "393032c8-39d8-46f6-9704-c78f2a32adca", "value": "T1C2E35C91F283E1F5D80A05355067EB329D73A676713BDE81E7BCDB32AC12601C917AAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764674490, "uuid": "ce60d376-b7e7-412b-98c9-4ada112d7446", "value": "3072:RxX9rsKPZJAOMaEahs3BPUpuz79ZYF7B2D6L71QP1jiB9:RB9wKPjmKhMBPUpyDip1QPpiB9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764674490, "uuid": "ce79ab6d-ef72-4ad2-8416-74cfad5938ec", "value": 154352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764674490, "uuid": "0a47fb2a-8ee1-4fcc-b9f1-47b4f2ce3f19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764674490, "uuid": "11322ef1-b4a0-4ca2-a415-4654c8f93e03", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af0aa4d5-cfa3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764696237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696237, "uuid": "49a88d62-3c75-4f93-81c1-d56d0ed7959a", "comment": "Malware payload (Mirai)", "value": "f0d8bd3ea84875280ffb4040a58abdaa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696237, "uuid": "53ae5a54-3f1a-4e06-aa3b-82687032205e", "comment": "Malware payload (Mirai)", "value": "719eee4e08d4bbadfa23ea0984af3d5912863e7b2dac21877e95a2fa4c8d19d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696237, "uuid": "9c3c723c-e957-455a-8df3-3d253f792dfc", "comment": "Malware payload (Mirai)", "value": "1509927bd942fa053228838792cc917658597e35", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696237, "uuid": "9ab9743f-f00e-4854-bc82-2da979f7ecac", "comment": "Malware payload (Mirai)", "value": "5d96171014f2af0d64ffdc3540b7425aa9f55e7d604e6730d7c65ae7f81da4ec00598d47431cf211fb55f8347db43959", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696237, "uuid": "5cca79f3-f89c-4227-bf09-52e7905b8e14", "value": "T19A04B81E6E228F6DF668873447B78A34976D23D627E1D684D2ACC1101F2039E645FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696237, "uuid": "2d406da6-f5a5-4eb6-a37a-e7d3cba34178", "value": "3072:ZX4inBp+5+i4i+tq5HhuZ4vfsdJ69m3fWszhqZNZVC:ZoiHwiLtq5HkL73fphqnZVC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764696237, "uuid": "9eba296d-0439-4af4-a0ca-9f5af7689c08", "value": 186084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764696237, "uuid": "348d0b9a-b18f-4531-a58c-7360ab4af4c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696237, "uuid": "aa7f5ec7-f31c-4da6-bcbe-48645759fc8f", "value": "nshkmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83e73991-cf7b-11f0-a129-42010a9c0007", "comment": "Malware payload (MassLogger)", "timestamp": 1764678984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764678984, "uuid": "75a16b28-157c-4d03-a59d-ba560c2904e2", "comment": "Malware payload (MassLogger)", "value": "d2d16125157929961b3ac331a3040188", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764678984, "uuid": "33c751e4-31ad-48e3-89f0-8763ebc47bbc", "comment": "Malware payload (MassLogger)", "value": "722f03602e2f49798b90975a8abbd3270b984399f49286f876c3156aff671959", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764678984, "uuid": "b446750a-a57d-4967-b9b5-ac31614b67ea", "comment": "Malware payload (MassLogger)", "value": "ba2bcf230c472abedc65e589b9f4644b72b699a9", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764678984, "uuid": "50135aed-f987-4a97-a046-2df46a5c08eb", "comment": "Malware payload (MassLogger)", "value": "31476edf8e9307b9e2db6071265f5be95eaa39b4c16954538c88570d288fc875c98349bfb36de1971ca9d84cc806c1cc", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764678984, "uuid": "7711c94c-be6a-4da6-8f52-835fd497bea6", "value": "T1103533408DB9D99F06FCC52EB15D642B89414F4786C0FA82BBDC77A7037CA455A8F8B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764678984, "uuid": "6da8b12f-ee87-4ce5-a820-7e16b7999e5e", "value": "24576:0QhwIagboDCL1KMpctZt07w0kXvYIb5M43jxvffX:Ht8CL1zi1dPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764678984, "uuid": "240806ca-9ed2-4569-9228-1ecbe1c626af", "value": 1067400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764678984, "uuid": "b17025c0-8d98-436e-a136-c3f846e00580", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764678984, "uuid": "35506052-d3f3-4c70-b056-6d9da2a88a67", "value": "Encrypted_Script.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ad80434-cf35-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764648904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764648904, "uuid": "5d72e483-550a-456c-b81d-902704a857e8", "comment": "Malware payload (Mirai)", "value": "c95a6a4221653410103ac5e3e090687e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764648904, "uuid": "c2ef3167-8a47-40fd-8c11-212f262772c2", "comment": "Malware payload (Mirai)", "value": "73653afa4ec49b4cdbadd7d431e8392f2fb5e09929d30fdacf0317f04fb9bf60", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764648904, "uuid": "4f04e639-9934-479f-9c94-72624e6d3b97", "comment": "Malware payload (Mirai)", "value": "5e4c373b0edb407d4edbfa79f177930c2d606063", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764648904, "uuid": "bf50f073-7074-4e55-8d14-ac0b6c3843bd", "comment": "Malware payload (Mirai)", "value": "e0b1aabc5f328e4adff955f545204f35f1e8f23f05d4804b7d227301a587f69f072a2f53dd500a088ddaf4159b25facf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764648904, "uuid": "abf42692-f60b-42e4-a675-85e7ac3f4577", "value": "T1C0148120FA0663B1CC720A3897996E5A6E7B04559FEB26312D1F533DDE628508F30F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764648904, "uuid": "f2736077-3c91-48d2-80f1-5e640899b0e0", "value": "3072:yoR8f15DOIH29cwnKJoffbaXf+RJwtX8fUKE:vR83DVmc22WRAMct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764648904, "uuid": "8f9a0b8c-37fd-4e71-8a86-0ccaf0548553", "value": 197268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764648904, "uuid": "5b410e42-4b08-4e4e-86a3-e73256e17035", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764648904, "uuid": "ee2b2469-1814-47fd-baef-843302c4fc42", "value": "xnxnxnxnxnxnxnxnmicroblazexnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9653f055-cfa6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764697484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764697484, "uuid": "a3049cf1-7bda-4a3a-a300-0b62acf24219", "comment": "Malware payload (Mirai)", "value": "d4a6f40442da9b11a3d0cbe67799191b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764697484, "uuid": "e1107367-91d1-4053-ad7a-b323a24ccee4", "comment": "Malware payload (Mirai)", "value": "7382e9eed7e207cf41c8137690eeb5d3d7e66c30c1fec337b6af7f14b900a385", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764697484, "uuid": "f68f4234-44a3-4f6c-b574-36551f5b00cd", "comment": "Malware payload (Mirai)", "value": "89d45ff6c3ea347071c15e087dc5cd2d930d3b7f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764697484, "uuid": "3a436e2f-d4a5-4433-b2be-e15b318284e9", "comment": "Malware payload (Mirai)", "value": "98bb5254550e4038b95f241d3179360844ada0c9794e46e60c7ba4a441ab0ce3211198da064a16b1c8bb544fa17c1cee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764697484, "uuid": "580af726-7303-4173-aaae-51fc30994172", "value": "T1DF436B256A7A2E17C0E4B4BE22F74754B2E1665E25E8C61E7D330E4FFF21A50A0436F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764697484, "uuid": "3e28c9f6-6faa-4adb-a438-54f5a6b76972", "value": "768:Cuopf8bQPAZqRU+fECeU6tq9bXV85PnXIsf0lkgUI7O+qoSJ/W:CuOoQAqRU6ECeU6tSbXm5PX5IfZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764697484, "uuid": "b20fd015-30ac-4698-b1e2-7aae39fbc857", "value": 59664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764697484, "uuid": "791c9549-d8e0-4d30-bd57-9eda51e3ec63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764697484, "uuid": "350ea38c-bcea-478b-a3f3-1928d21a265f", "value": "jew.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70d0c220-cf3c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764651894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764651894, "uuid": "d73df5f2-3992-4654-8fb3-08b58010e145", "comment": "Malware payload (Mirai)", "value": "1d69901b52ec5d2b5e8eae471c856ff1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764651894, "uuid": "267c5661-3d41-4217-891f-0a5e3bfae44c", "comment": "Malware payload (Mirai)", "value": "7478718856df176cadede54deaaddca28f59dc986ad46d726a69af87215cf693", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764651894, "uuid": "a3bcd471-7f8e-479b-827f-0839834366c0", "comment": "Malware payload (Mirai)", "value": "2e69d27a10dbb6447b3c603fb90c2d203d655b37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764651894, "uuid": "2f18ad52-cb26-496e-8d8d-2bc7204f5f1e", "comment": "Malware payload (Mirai)", "value": "6a6e53c3fe172d763ddb2cc847a79938122e5152e9ace3adce4cb1a51b067741d90e083b3fde1ad0670526b05405d890", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764651894, "uuid": "debfdbe8-a8ac-46aa-8e29-ebaaa688c0f2", "value": "T10FE47C237B51CFA9E358D27001F3C76459D125A30BE245AAA378D32C7E6066D292FFD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764651894, "uuid": "fe3e01a5-12d1-40b7-92d8-eacf4c3c68fe", "value": "12288:IG1f1xBoWF2cKb61y8j5JyhABu1Fqh65WKezom+e+QWtqSc/bZmFIzikxQz0D/UM:IktxdTZ15jfubvezom+e5WtqSccOiBP4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764651894, "uuid": "e402ab53-0828-4691-9735-95494917e354", "value": 718776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764651894, "uuid": "e59672cc-c2f0-4273-aa37-3732e635f2bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764651894, "uuid": "61b3ea68-50a0-427f-b524-cd5fcd855444", "value": "sync.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2ffc243-cfbd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764707491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764707491, "uuid": "20d59825-c2e7-4d96-91e5-ce1b1e101f19", "comment": "Malware payload", "value": "01a091446376a18851b9bfe881f1bac7", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764707491, "uuid": "9af9e78b-eced-4fbe-a9fa-40651b0220e0", "comment": "Malware payload", "value": "74958b410e944f042c61e855916547a85ffd499abdd01aaadc470ada4a4d9bca", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764707491, "uuid": "0288a845-5edf-4525-a350-112c8637ef67", "comment": "Malware payload", "value": "b0990f8df008fa3c54209ee37bbd74de03ad6ada", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764707491, "uuid": "5fc263c1-7228-41b2-9002-2d74eb9273f5", "comment": "Malware payload", "value": "0c6dda09f2e5689e4426b561205205e34909e81f815367af43126b57a7d89c989d2c9de4d81d5e47e9d5b88a5e40779c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764707491, "uuid": "ae4c145d-4d80-44f4-bc19-75acdfc9e732", "value": "T13A54E001A7F91155F6B7AFB55AB245668A3AFC206BB2CADF2081115F1C31BC08DB173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764707491, "uuid": "da7bd905-d58d-44e9-83c5-1c9e4e1a289f", "value": "43843f737ba899f89b83bbc52773c3d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764707491, "uuid": "f1faf888-bdc8-401d-9083-498ed25285d9", "value": "6144:euWCU2F8IW+bNUYZhCXNpPcTQOzEHEH/M568VVPXaK:8CBb9nUOYw8VV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764707491, "uuid": "381a3b36-336f-4edc-bd73-5e8599551990", "value": 303616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764707491, "uuid": "96076cbf-943a-4659-b322-7314e4440903", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764707491, "uuid": "2b438620-3d8a-4cee-8389-a565be430203", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b61ea38a-cfa3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764696249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696249, "uuid": "8711d778-59d9-4c7c-8b6c-84d6f4f4457a", "comment": "Malware payload (Mirai)", "value": "93394a6033f87c4c533eba2a937d6620", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696249, "uuid": "e4560b50-26f0-425a-bfda-5f360ab6f38c", "comment": "Malware payload (Mirai)", "value": "74c792991817cd2df38cec8d85767e98b8001fa24a0bad3b3f8b54b532541e41", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696249, "uuid": "a1639b4d-8484-48ff-abeb-dff793898290", "comment": "Malware payload (Mirai)", "value": "222bc3904cea93faf6d03f428ba12c8a83c9fa84", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696249, "uuid": "8f62c940-db42-40c3-b506-79bcbd518e3e", "comment": "Malware payload (Mirai)", "value": "bf7014cfe2ef2c6b624ac3518a7bc466f24dc59372ab484c69deaa9172f9a5fbcc48e2f1585c26782150688652250523", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696249, "uuid": "b29ea432-cf5e-483b-b626-8740fefb064d", "value": "T12DE32A06B30C0947D1A32EF43B3F27E193EFDA8121E4F640255FAA4A91B1E365586EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696249, "uuid": "7b1a1cda-1b15-4ef5-9d93-4eacd6fb2d00", "value": "1536:VqdOjIDYAW9M9vxFfD9zCBVbgYChxXnmpPEpU/kvAeTqjJ1xBDUeq8YmjJDn:VV8xTKSxXme6egjhn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764696249, "uuid": "dbd58d80-33c9-46b7-aa67-b9eceae67346", "value": 146124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764696249, "uuid": "8b6c0190-728f-4a68-aceb-ce7d8e5f2284", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696249, "uuid": "03ca73a0-e61b-4f39-8f08-28087b4b2faf", "value": "nshppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aca305dc-cfc6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764711265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764711265, "uuid": "64f63f81-6bc3-41e9-bb57-8036c46307b5", "comment": "Malware payload", "value": "657cf25107f34bc6352a94554871dd27", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764711265, "uuid": "54da50ca-6951-4f04-89ac-31f9c1f30639", "comment": "Malware payload", "value": "7528acfbffd12f72017dfc1f8ef8e0fc816b970f7efaa493ae473cddb38c69fe", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764711265, "uuid": "56d546b2-0591-43e5-9c79-80d659812457", "comment": "Malware payload", "value": "4397c8d19ed3ce031572e758fe26a50a8d96debe", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764711265, "uuid": "940c3b89-67e8-433a-9abc-de8b794f9adb", "comment": "Malware payload", "value": "3a2ed2b116a6948a0c0683d186207e5dcb96f73ae2256a83e988c32e01c89c43a12b5b2504dbb26010f61a5956b08787", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764711265, "uuid": "0912de4c-2fb5-4aad-82d8-783b9569749a", "value": "T18EF2D0231D443F909BA12A006AFD22C953DC5BCE4D936D8DE523FD4A669A71D24FE09C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764711265, "uuid": "f1c437fb-cc68-4d7f-8ef0-9ae64a78d2de", "value": "768:lIXsdbeYuFZhOsEBoXoWtxMvfOzNpTG1LvhcAsebEPkV4ZI1XNLd:lI8dbaizGzvhzzTELFbEPCw0XNJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764711265, "uuid": "a073a2f0-ec2a-4468-b250-85db50dc67c8", "value": 36926, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764711265, "uuid": "a9dd8c3d-9581-4972-8c3a-f63fc0d307ad", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764711265, "uuid": "a458ba17-f2fd-425a-b494-65345a019506", "value": "kryo_crypted_c9wmaqzo.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43b273ce-cf5f-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764666851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764666851, "uuid": "bf9eb8f0-9da9-4190-ad09-e1452e2c1056", "comment": "Malware payload (Gafgyt)", "value": "3e0bc7c61cdd8849ebbd7222f966133e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764666851, "uuid": "76cb7cf8-0c6c-4139-9492-097743b282ce", "comment": "Malware payload (Gafgyt)", "value": "76218b2ead0430cac431b3a083d8ac1e3245e78b3582ff1434cbe297df25d779", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764666851, "uuid": "fd842ddd-4571-46d9-9e29-28ba07cc2ae4", "comment": "Malware payload (Gafgyt)", "value": "30218dc1b5a3c68f15d22fa4c57c1c0b8b83977b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764666851, "uuid": "a7266b4b-4211-4996-bebf-9578c159a36c", "comment": "Malware payload (Gafgyt)", "value": "046a7479e09685615df5f1ad840fca5ea7a50b743ffcba701ef7c1cfb594b779e044c72ecfcece707bc2ceffae07cce7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764666851, "uuid": "001ce0fe-bab2-4505-b680-63b1c6cdaf2a", "value": "T1F653F905F950871FC6D277BBF75E039D373A5A58A79B33116A382EB03BC5BA42939120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764666851, "uuid": "82fee7ce-606a-4f85-ba2d-02b6cc52c9a0", "value": "768:0WxHNAAkh60EofRDJFgSOhXFWUec2iRxElK0cENgpeiBmS1/cd+MaaSwKrAgDd:7HNg3P3FgSOh1MhiRx1Zxe4GADj35", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764666851, "uuid": "fae88900-7e52-4dce-bbd1-40ab1cfe23e1", "value": 63760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764666851, "uuid": "bd5b2b83-6eb5-4f31-a773-40b81cea7f4a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764666851, "uuid": "61f205e7-ee36-48cb-9084-f38ec392a93f", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1b261e5-cf85-11f0-a129-42010a9c0007", "comment": "Malware payload (ACRStealer)", "timestamp": 1764683464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764683464, "uuid": "aad6f16d-5365-484c-967d-de287a6625b1", "comment": "Malware payload (ACRStealer)", "value": "f5bfb672d4bfef9596c2392e8a3959cd", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764683464, "uuid": "c5a7877b-31d5-4329-a0f9-b73bdb2ba15b", "comment": "Malware payload (ACRStealer)", "value": "762e9798ed3bf81bc36974e801755d4a493f0d61afa9604b380e4d0646ffcbd2", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764683464, "uuid": "cd843756-891c-43d2-8222-10b79fad11f5", "comment": "Malware payload (ACRStealer)", "value": "21ff7f559b0b4eb5697bd3dbc9bef9f30af607f4", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764683464, "uuid": "c77f3738-34f3-41ad-8b34-723337faf149", "comment": "Malware payload (ACRStealer)", "value": "4515beec51242cd15fe7b2a44db28eced1048ded53cc1b05eb5edc856aa016f1f8d26609e12252c92e6eac52265669f3", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764683464, "uuid": "3c126036-63c0-4e69-a008-99896fcb2342", "value": "T1F5D49FDE1C99839EDF5CD27C1D68BB458AFA562E84B81415CD30ECED384FFA604A814B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764683464, "uuid": "106a60b9-d9b3-4aa7-bd6b-0c15ec55f86e", "value": "ae7cd1b9cde5396babfa7a3dddd5a850", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764683464, "uuid": "5c6d474b-091a-4562-ab7e-0ac3f9309830", "value": "6144:d/8PpYXNbEaIjCDMipLuWeJZzeRwjlMAByeFo6G:djFUjCDMiVZeJZzMwRrYAo6G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764683464, "uuid": "7b010010-feb9-4e49-b0f0-e24b68c143d9", "value": 642000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764683464, "uuid": "2b2890ba-79e7-486a-a60d-7175c77da9fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764683464, "uuid": "2d68cc99-8128-461e-98a0-28179e77c74e", "value": "mal.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3413d4c4-cf13-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764634183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764634183, "uuid": "f37237a6-b6f3-4c56-8b4a-37227ed8e0ca", "comment": "Malware payload (Mirai)", "value": "21716c7990db9cc4a2e5ca6365a8b921", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764634183, "uuid": "d79e8e6b-684e-4e7a-8883-45beb470c6b3", "comment": "Malware payload (Mirai)", "value": "771f8774289266bebfd663e5fad42b123b34a10c13827eca4e29761a6c7aed1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764634183, "uuid": "89421157-bca7-470c-b3f3-ccf47b222353", "comment": "Malware payload (Mirai)", "value": "f02f3ac31f9b9d00867383ba095db24d5bdfedd3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764634183, "uuid": "7c66454c-9cdc-48c6-8540-f5fc41a81a30", "comment": "Malware payload (Mirai)", "value": "a2d1fcc70bee8b6e88796e0d771e85146fca75503a9fc5e96a4095b4ec907c62a8049b819167afffbafd48f85f9dc6b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764634183, "uuid": "9644b196-5301-460e-9213-8a5bcbfe1086", "value": "T10713F1A54BEE013FD41F813B86EEFD5F1068784EA74641D2EA200D5D69C9B983B14FA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764634183, "uuid": "cd6f71a6-d24b-4a36-ab10-85bfa15dc366", "value": "768:10GHCnyNlWx3Nxq6wsqRAACcXVwAeesZAG/DlW13PqT8HA8+F6LnbcuyD7UHQRjZ:102CnyNwxTq6wfA2XOANWDblWRyTZ8+n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764634183, "uuid": "eb7a7fdd-a8b6-4f6b-a53c-d04077e57690", "value": 43740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764634183, "uuid": "d2d423b9-86bf-4c83-995a-e9819cac4650", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764634183, "uuid": "ecb1e7b8-628f-4ce2-8f73-85e1b9b00dcb", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0508a07f-cf94-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764689509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689509, "uuid": "4bb56f5c-b48b-4cbe-bed8-e71b032a821e", "comment": "Malware payload (Mirai)", "value": "80fe117f21d9d838aa99e4c6038581fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689509, "uuid": "4758198b-0c85-424a-ba4e-a506848d079a", "comment": "Malware payload (Mirai)", "value": "78558e7a8f669eb6fdfc8875e7549db054ad1b0808df070cbc4a7357ed66c844", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689509, "uuid": "79092412-1906-45e3-90c8-77a9195f1746", "comment": "Malware payload (Mirai)", "value": "d225a07a930e853a71c885270838c182a2e5e539", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689509, "uuid": "0098d72d-075e-43a6-878e-097ca5a04097", "comment": "Malware payload (Mirai)", "value": "26edd82f688987f92f466f65ea17db0485ef7da2f88542db354aa361133523bb9f3204b641111504753a4c085847a0d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689509, "uuid": "79130ed2-8fc9-4676-81fb-c61f0cdb584f", "value": "T1EBA31214806CD6F082219D3C6D57CDC3384A73EDA87DBD3AE4F1425986E7869A0B19F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689509, "uuid": "507b1342-82f4-424e-a16b-82efa15e9d79", "value": "1536:uWEncaNNxPoIit8rN6tD0r3z1VYh+4FN26zQWPPoF0MV2luWPouvn9CPLuhH7i0c:8NNql8ZsD0f1VYh3n1oF+xvn9mLuYf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764689509, "uuid": "9b6182b9-4081-4b91-b1ff-d1c0ca221e50", "value": 107248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764689509, "uuid": "f800ccd9-100e-4bfb-8c36-67d0afa50a5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689509, "uuid": "ae816d95-4851-4f69-add7-1f09552a7a67", "value": "ecco.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09f471d7-cf3b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764651292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764651292, "uuid": "53926658-9ad9-4632-8c0a-46d75da5c46f", "comment": "Malware payload (Mirai)", "value": "5f41e3e3d337462f0e27e5b62c6ce709", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764651292, "uuid": "af54ba36-337e-4c33-b792-ffc837b993b0", "comment": "Malware payload (Mirai)", "value": "787f256a1c3c37fc9f17326edbeb1359aea1fb1ac831b761b05583997aa8dc71", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764651292, "uuid": "1cf80083-1dbc-4790-a1b6-897a25296ff1", "comment": "Malware payload (Mirai)", "value": "adbe8218a8ba786d3f4ca7452e235e320edc14fd", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764651292, "uuid": "0063a03b-6a9f-49cf-b465-f3383a666757", "comment": "Malware payload (Mirai)", "value": "cc2695ec4e896f84ba10e0076c4a35fb37bb55457d454f2a9c15f84747b109dea4c617b81e39fd3035ca336bbcf58d0f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764651292, "uuid": "0a3b5b47-abbb-4591-8022-1bc9dd75eda0", "value": "T1F201E9CE41902B754DC8E90FB5938E1C104946CA0B8A17CA7EDC5837ABD4ADEF004E58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764651292, "uuid": "6e1634b4-a6cb-43e2-9cc4-51efe8b1b0ca", "value": "12:KSs6wZFYmFYQNyHe0fFYRswJGSYeJB/JvpLFrynFI:KSKZFJN6NMsnedpBryFI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764651292, "uuid": "ad4667b8-376e-4659-989e-e4808488bf04", "value": 835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764651292, "uuid": "e01711b3-f483-44c1-88a7-12f55b3324e6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764651292, "uuid": "5778b510-92a3-4d1a-bcb7-4e5553a3fe95", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b562ca2-cf27-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1764642704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764642704, "uuid": "72983d63-d1bb-4689-80b9-2484206450e4", "comment": "Malware payload (RemcosRAT)", "value": "e4d0d348b5a9732bbd5c1c6800f75b45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764642704, "uuid": "c48ce9b3-b888-4d82-98a5-f7beef27ba18", "comment": "Malware payload (RemcosRAT)", "value": "79550414ab0554d42cf6478dc85df5b86deacbe26ff6fb1c7dbfc058fd520390", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764642704, "uuid": "07c3548b-e440-4ba4-a781-dff5426acdb9", "comment": "Malware payload (RemcosRAT)", "value": "062cd3ca3571db9429bc7cba4f9ac980f420ff75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764642704, "uuid": "b35b8cde-edd5-4591-b2b8-5896a6c49580", "comment": "Malware payload (RemcosRAT)", "value": "f27897f8a8ccf22807f46f29950d7f2492f7088e9fcf99e7f652180e16e0dff7de79e67b4ea61f7e95092f39e74420f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764642704, "uuid": "889496b5-771e-4c05-819c-11c15d50d1e7", "value": "T1663523943258D413D8555EF01A20D2F2A77AAEAEE821C2079FC57F9FB9FE7504A02353", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764642704, "uuid": "d2658fc7-f765-4417-b950-1e05b38a5446", "value": "24576:fm9Qlt/8wfCzEklqa5hv6KZzkW/Ka+WV49BI3hw7Pq2sz:fmkl1a556wzkuj9u9BI3hw7ze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764642704, "uuid": "b148a2a6-73bc-4816-b9dc-2a68c51f0379", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764642704, "uuid": "a6ab0f39-4ec7-4c57-b865-d00d93e8b2cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764642704, "uuid": "3e81bb9e-459b-492a-b185-54886582f8d7", "value": "CFS KEE-ISF - SO#4622- HBL#6810974399.xls.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8296a97c-cf58-11f0-a129-42010a9c0007", "comment": "Malware payload (Amadey)", "timestamp": 1764663950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764663950, "uuid": "6b6c2233-5c60-4831-a748-76e17221529f", "comment": "Malware payload (Amadey)", "value": "c95602d4cc0eafc4d7743138118b612e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764663950, "uuid": "72153eef-cd89-4b58-b416-8eeb81b10487", "comment": "Malware payload (Amadey)", "value": "79b120acdb37fd5b5fa927a6ffb370d5a7cbc8039f2e9b31831029d0f16bc38b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764663950, "uuid": "6c60dd51-898f-4a77-aa00-3a3aae769d99", "comment": "Malware payload (Amadey)", "value": "c6e216a64a83767111b2fd8154c0f48809cd5344", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764663950, "uuid": "a5f40851-5b49-4d85-942c-31fa62a1c9d0", "comment": "Malware payload (Amadey)", "value": "073aa8b6fde6b069c109dd4e051007ea674bbec7186c7c856d8096cd2d191fc229e0c392c767b10f2c46dcb64fb55624", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764663950, "uuid": "8f02d952-b103-443f-a309-60e9254800cb", "value": "T1E7D412A773F670F8E29A8675C8514669D3B7F0720A155F4F03E086A92F636C01D3AF62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764663950, "uuid": "b58638b6-9d88-49c7-b2a6-36adc7d1ecd8", "value": "f35919722d8dcde279077a8460e70b83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764663950, "uuid": "8ce146f8-1a69-4f6f-9477-dc42ec96683b", "value": "12288:kUCWn0vlIHTkAd4OnRGZh/ls+w/stQPn8LZCe+gntFdyg:kt1KoAd4U0NrwEtK8LgrsPdyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764663950, "uuid": "202c7dfd-f9e3-4feb-b418-1215a5f09f5c", "value": 620032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764663950, "uuid": "ca0e3e15-c53c-4989-91c7-9462495e30ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764663950, "uuid": "ad6c3bd2-f5bb-4166-a9f5-f131683a16ba", "value": "Crypted.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b7f3123-cf90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764687990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764687990, "uuid": "4a2c7931-8e94-440e-a5fa-e3714de794b3", "comment": "Malware payload (Mirai)", "value": "68ca8245c059356b821010971ecfed62", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764687990, "uuid": "922fb5fb-f6a4-4985-abf3-c107f1a1e7cb", "comment": "Malware payload (Mirai)", "value": "7ae30d8e300cc62274da2bfef5c4c98568affc8dae7af54bca951032a0acd8ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764687990, "uuid": "ea7a3bb3-6c78-49a4-91fa-01b2a0caf96b", "comment": "Malware payload (Mirai)", "value": "36f3ce308b13fabe2be307a6dd5dabd35324524f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764687990, "uuid": "ad8ee93b-11ba-46cc-b8bc-8f1ba16e7db1", "comment": "Malware payload (Mirai)", "value": "da9e5f5d6d20e32c365687d1db7e6f17fe20d4409a09a2729c307759ee8ee584d169ad493e8d3a1e4bf8020390018df0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764687990, "uuid": "20f01eb1-1fe3-499d-878f-4e6ed922b803", "value": "T19ED2E13C5330E4A098B01F77F971CA9A7665473CF0B6B4221A2A5EE85ED35829EDCD07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764687990, "uuid": "326bcb3c-ada2-4282-8ae0-29fca3c00461", "value": "768:pEdrEbXKDnI/U//XNbhrgGOEbGjXB9q3UELFF:pLXkSUHNbhrgzEwX0LP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764687990, "uuid": "f07e5569-0f40-44b5-b89f-78bdf62c596f", "value": 28464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764687990, "uuid": "78d22805-b160-468b-aa20-3f910582ea4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764687990, "uuid": "f893e548-3ffb-424f-a008-daabb39d07c6", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a94d80c3-cfa3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764696227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696227, "uuid": "605c413e-7fd0-4100-a94e-c4d108a9459d", "comment": "Malware payload (Mirai)", "value": "2d8c7bf85373c33e64ef2521f98ba850", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696227, "uuid": "d1f369a5-fc67-4e6d-8912-766fd2724833", "comment": "Malware payload (Mirai)", "value": "7b3ade5a4dbe0034fab3cfdc994a87a452f3b62e7d05091b7de242544fb2f23d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696227, "uuid": "f958d60d-997c-41ed-8b66-b749ff4ebd78", "comment": "Malware payload (Mirai)", "value": "9cfd190a26ebfeae59faf7e72a9ede7f657d16ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696227, "uuid": "e5c92503-89ea-4ea8-8613-0621b2f2298a", "comment": "Malware payload (Mirai)", "value": "99eb9dd41ade46a10f015a0cf3d43a14d29faef667da7b9717a79d724f6fe0e7fe585751f4846b5244a4598f8a9bbaa6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696227, "uuid": "1fe373c6-d11f-490d-aca5-5abddc443f23", "value": "T151D31A45FC514F23CAD112BBFB5E428D772617A9D2EE72039D255F24378B86B0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696227, "uuid": "b458bd67-979e-43ea-8711-62876d8bd08d", "value": "1536:KfyMy6l1fDJfy5wJcRKqG2ZJZ4VyvkuTplrudd+IWCAB3JMli0wywr1vwTQiaalM:Kf3XfcycoqG448x1lrudF1g3CNtq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764696227, "uuid": "170330b5-48de-4d23-b427-d4f9a9bb2d07", "value": 141920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764696227, "uuid": "0569156f-362b-425e-ba46-e5cfbf12b021", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696227, "uuid": "4114b4f0-9fd7-487e-bd20-720c2744998f", "value": "nsharm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3f375dd-cf70-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764674421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764674421, "uuid": "fecfb2f0-9963-4280-87cb-edf49cfff2ed", "comment": "Malware payload (Mirai)", "value": "c4be7a1ee2b94901b87b53981c3b9b76", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764674421, "uuid": "660052ab-af00-4257-9ac0-697d1067e96c", "comment": "Malware payload (Mirai)", "value": "7bb510a1cc57ce92a4c13400f0dc8f7c1426b387ee1dc6361b357d2577cc8572", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764674421, "uuid": "c54466f6-9027-4c20-bf7e-6b493a6898c4", "comment": "Malware payload (Mirai)", "value": "ffab540d9a0bdb6c46baf1c72e313c4db0987f2b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764674421, "uuid": "5018231a-df6f-4453-ae85-f15f8a2138b2", "comment": "Malware payload (Mirai)", "value": "531a717915fc263d749a9ba62dcb944b222037f82b84958087be21757a71686fe8b3421546f041c645b98621e187b4cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764674421, "uuid": "b3b56f5a-3043-4ffd-9d55-241597fc6922", "value": "T1279302151AA74A04EB9302B7A87C061D3B1F1BB411F9757A225000BB7E73608FBF5D9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764674421, "uuid": "ce790c11-7b0a-475f-8435-559f2fd5be5f", "value": "1536:4VkA3JEBaWWPcKNlltqJMQARHLdKIEV7fAfOb6cY1qMLYI5/qcuHZFG:4Vh6krzeMQmHLdKIEV0OWRqMLYADKc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764674421, "uuid": "bde9ea58-2da2-47dd-bc05-346d50bba092", "value": 93416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764674421, "uuid": "d89eecfc-9424-47b8-90bf-aee2f6369fa2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764674421, "uuid": "67aa99b1-fd64-4a7e-aca6-3bc9375c5f31", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8172a51f-cf90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764688000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764688000, "uuid": "15081970-1560-4bfd-b0f9-767a40dfd2d8", "comment": "Malware payload (Mirai)", "value": "2550abc06a8313cbd9ee6582551c8765", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764688000, "uuid": "1fae7ffb-d785-419b-ad35-54821b7586b0", "comment": "Malware payload (Mirai)", "value": "7c19fbd082b182d79d4d2048e15b799d2e025f6c111aa96ce864759a9be1192d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764688000, "uuid": "5bfa25e0-4174-4124-9cff-53286c51a1ec", "comment": "Malware payload (Mirai)", "value": "c1d40bfdfe092f38cb9d6ab70a760677600013bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764688000, "uuid": "4734c08f-6fbc-40c8-a5a2-c3762d66f903", "comment": "Malware payload (Mirai)", "value": "9f5e2c4f309f910d9f80af9630d401b140d2d859b347441918ce541ca4180f2fb696ba79c45aae9546a15272c7db2402", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764688000, "uuid": "84f7db20-34e2-4817-bf93-f7ee567d050c", "value": "T11EA2E1BA800A0C8ECC6C6C3EF9A91DBD1610CD90635FAB613B5936D067B1AF91F18086", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764688000, "uuid": "5a8fdc2c-55af-47c9-800e-88e91f8f56c9", "value": "384:MaBYkBav+RI0osUsgoaFLmn83awJ8f+1AwYhfSLwoIAUWtJL3RhFD/U+v1RD:Dhl+tz1y83awJ8f+1LYMLwoVHtJXRD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764688000, "uuid": "cebbda44-21a2-4d3b-9eea-bcb72dc48fa6", "value": 22556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764688000, "uuid": "c5b937f1-ecd6-4e8f-aef9-1c4862e26963", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764688000, "uuid": "220bea5c-8bc3-4ff4-9e3b-8e3d8966c86e", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2969403-cf9f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764694578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764694578, "uuid": "3fa22c20-3306-4fc0-af79-5bc3dde479a9", "comment": "Malware payload (Mirai)", "value": "f4de016c2f936b40bb890fc8c6e5830b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764694578, "uuid": "af60884c-6d33-47a1-b578-6898fb1faaf9", "comment": "Malware payload (Mirai)", "value": "7cfc3bb931f021bf74394697db7b63a7927707a95b398d19451765ddbcc4a8e9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764694578, "uuid": "9fa70626-af3c-4d83-b742-5aa4c71a8796", "comment": "Malware payload (Mirai)", "value": "50a46a736c4a9eb8018cee103a52d9507dc20396", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764694578, "uuid": "1a526053-5463-4cf4-97fd-2cd4daaf5e7b", "comment": "Malware payload (Mirai)", "value": "f1db37b95a06127b2f7ccfc8ca6cdb4cde7f69bf7aa30ff7995b5a9d4c5c2e7ca15682b078ad6d32876e5001e74993c4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764694578, "uuid": "3aea0573-99a8-447b-a285-f3747ecaf4c6", "value": "T1815182C6B3D24A34EFB55E9A79F641247480E19967C3CE86E0FCA4BC0D4EF0A5490B96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764694578, "uuid": "f55408d9-e802-4e92-98ad-6544808cd9ba", "value": "48:vXHW+HWYHWOHW0HWUpzEHW7HWgHWVHWSHWKHWYqUfHWLHW+HZ:vX2+2Y2O2020E272g2V2S2K2YqUf2L2a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764694578, "uuid": "48641b60-8482-4d50-9af7-5c42c9f49ed1", "value": 2821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764694578, "uuid": "903b26ee-241a-48d8-84fa-cb3ab5221b0c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764694578, "uuid": "0bb5b740-bad1-48d0-9014-9367f377fe28", "value": "hnap", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79e380f7-cf90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764687987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764687987, "uuid": "38eca1a4-baee-4c45-aa67-75d886bf8a3d", "comment": "Malware payload (Mirai)", "value": "7f2eaa12c65cfd21a14e312aab318dd1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764687987, "uuid": "54c24188-197d-49d1-b25c-7b27a17568da", "comment": "Malware payload (Mirai)", "value": "7d7bc55bea834df5495755ad77c5713bb21655e6a13b4acc42b0364e086412b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764687987, "uuid": "c1f804cf-3834-4837-a772-4ec75321d3c9", "comment": "Malware payload (Mirai)", "value": "95f058f5f54c3090afd07624741daccec0cc45b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764687987, "uuid": "e82913f9-8ed7-4f05-99e0-01d306a89723", "comment": "Malware payload (Mirai)", "value": "f4841710c84a1b9b51ec72fd78124be6d4a78351c923df239aa0b23868ae19e34ee513f4d80f03145d9eb7f80bc24e23", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764687987, "uuid": "e613ffff-8666-4336-9ad7-981b1375d5b7", "value": "T1E353426DF4034A3EE58B9575249DAF0A7C3027C163C2AA1767B6AAF27CB30576D01DC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764687987, "uuid": "71bced3d-00c0-4eee-b4e3-815a273c55b8", "value": "768:5ee6ZrouuuFBnxoi0Lrfd6WXqTl8o6MYZ2z4r0XOZK5EhLG/K:5hEou9ai0LjdvXOl8o6MZ4r0X0K5l/K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764687987, "uuid": "93d72d70-f684-4552-9df4-37da94267f94", "value": 66204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764687987, "uuid": "6a0dddf9-adc4-4072-9864-c9045dac495a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764687987, "uuid": "c465b5de-6bca-4804-8e91-1eebc0a7961f", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b8b832b-cf49-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764657335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657335, "uuid": "fc8b5246-c93b-48ec-bbf7-db3788e8f402", "comment": "Malware payload (Mirai)", "value": "22ad96aea891ec55bc5e2b39d2a94b19", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657335, "uuid": "f5d5490c-e77e-46f9-8c57-bb785e91877d", "comment": "Malware payload (Mirai)", "value": "7e0ca445af14f06c37bbd1365c330292dba2e559447ea120bf0474089ce0fd8d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657335, "uuid": "c4945322-94af-428e-967d-bd25f1607f41", "comment": "Malware payload (Mirai)", "value": "6bdaf04b4d68ffe507828db3a282a40f4134ce85", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657335, "uuid": "2a6ddf1f-5a2b-4558-ba2f-8ce3cc293662", "comment": "Malware payload (Mirai)", "value": "7bf551a8a231dd907a1e180b661f93f3c765fe418715add708edc8cc26b045fc0be1ed7c19ce8242a03da89152a899d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657335, "uuid": "f24f31ae-9ff8-4d9e-bbba-3a1485bfe6fb", "value": "T170735BC1DB43E5F8ED6624B001B7A7258B7EE43E013DEB95D7A46A31AC12B00DA1779C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657335, "uuid": "7893aeb2-dc17-446f-9d19-12aab2f8f80a", "value": "1536:Khigu1znxWPIPBd6kK7GjGkM7hku1qutirtGCk:6Hu1znx4IPBd6kUh7Sunt8Dk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764657335, "uuid": "dbec2558-12f4-4602-ab8e-b775dac4fd93", "value": 75148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764657335, "uuid": "dedef429-4644-4b6f-be15-67e5c9c96a34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657335, "uuid": "3f7cca39-e54d-47fa-87b3-427bd93413f9", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abbe6aa5-cf48-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764657147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657147, "uuid": "08c742af-a77d-4a50-b25f-ea1ecc783708", "comment": "Malware payload (Mirai)", "value": "a2d9c7627da440f032dc9e20b39fcd7a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657147, "uuid": "c9a4140e-a5fc-485e-b510-3c21279e185d", "comment": "Malware payload (Mirai)", "value": "7e345cff100b72e1ea544d4f598c6d74e5c6fd3544e98ae725289ab8a3d47662", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657147, "uuid": "cd34def5-87fa-4744-af1a-b94c28803008", "comment": "Malware payload (Mirai)", "value": "b61bebd6dc373c5fbdc90316ee44e674d7db0cb8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657147, "uuid": "745f0a75-2abe-4c23-a712-056f40bd26bd", "comment": "Malware payload (Mirai)", "value": "c25c79f2677de0feb02366cbd9cfa8086c9fa1c5bf7b518defde03fec54d276284e1d6377da2e02da7c0de5e6a7c0f9b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657147, "uuid": "0d997416-6ed6-4dbd-a5b3-6a3591d912d1", "value": "T1F193296AF880DB16C6D4267AFB9E118C332217B8C2CE7106DD149E3577DBD5A0B7B602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657147, "uuid": "6906891b-cf3d-4aee-92ac-4f58576d13af", "value": "1536:Hve2QaYo1pbyjrj/F8SZdtQbic/vj4+ux53h8nRwtfOYq1ZWkzKZDN50BfvtZ0mC:PBQxDXOSZdtQbiqvcj53cKc31ZdKNcfA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764657147, "uuid": "3e7404e3-1d19-4cb2-9ca4-99347b5a25fd", "value": 95544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764657147, "uuid": "e72064fd-6c41-4cf0-b7ce-cc474bca44aa", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657147, "uuid": "82dc35cb-7826-4078-9bf3-a49197a2292a", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da387b56-cf7b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764679129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764679129, "uuid": "ec247760-a233-4168-851d-e0d385241ca7", "comment": "Malware payload (Mirai)", "value": "515af0a7b4c31d3bd0d91b4a834146cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764679129, "uuid": "d00d494f-a268-4269-a3cb-15f777c67de7", "comment": "Malware payload (Mirai)", "value": "7e4358970159a587d2ca5b25899e00714b391563e59b5fdf8d8523987245c4d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764679129, "uuid": "ab1d7eaa-cd45-4ab6-9a77-257e080d756d", "comment": "Malware payload (Mirai)", "value": "5c9f8a1fac5226bfad3004da40880d708f92238b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764679129, "uuid": "166ee8fd-40c7-430f-a9a7-4d3790333163", "comment": "Malware payload (Mirai)", "value": "c7727c592babb109ceb0c6f95eb706caebad9cf7cea4f4c0e224edb23a52e046ed0c6b3ea80196682aebffcee3e24c99", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764679129, "uuid": "a7b332ce-ed3a-49c5-9daf-1c3b95a78049", "value": "T1D4330A47A8A1AFF7D045BAB569775E24035BF9126F4F0A9A712CAEA0034F4CDB40F364", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764679129, "uuid": "78da2fe1-a8f0-403a-b3a8-1d9f84090326", "value": "1536:SesLEgUmX5B/N+5Zo+XT5tnCUZuhX/E3Uw:SeHgU25BYo+XT5tnrulskw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764679129, "uuid": "cb5adea6-d9fb-4599-9c79-04d048071c1d", "value": 53802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764679129, "uuid": "92b9ae8d-6c56-4f6c-b064-22f4a078ad65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764679129, "uuid": "dc8332df-7763-4713-975d-0613d0e268a3", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a114d720-cf90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764688053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764688053, "uuid": "d8e62b05-b466-4568-88f6-58d3700228cd", "comment": "Malware payload (Mirai)", "value": "8b04a415b204d3b14a2811dd1e1bce26", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764688053, "uuid": "ec68b6bb-29e9-4ebd-862d-2d5ea67460d2", "comment": "Malware payload (Mirai)", "value": "7e602ec3b405f39a4bc8b17c80515d80b32fc23f0a4d52129c3ff89828276e9a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764688053, "uuid": "b124873d-bf8f-4b33-b31f-f5a2ee9a104d", "comment": "Malware payload (Mirai)", "value": "24b4012f9fe23908785ffbdc65599a3767d428c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764688053, "uuid": "dc9cf9e9-359a-4dec-90d4-707e5623d4f7", "comment": "Malware payload (Mirai)", "value": "263ea669cf5494527c7b4a7b5b7dbcc18ee6441a64fbe43d439a936efdeb77c67193e46444cd9dcc38960748cc23555b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764688053, "uuid": "70fdace1-7202-4010-9a20-310c7dff1064", "value": "T10F43FB69F8424737C1D31275B5EDAE4A3F3063D8A3C6B117AAB007B03DE651B2C56E98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764688053, "uuid": "2ac77e89-aec4-4347-978b-21fd505f24df", "value": "1536:2f7mgsPoV4cLJ8n4mIfGAE77lAmQYDZv:I7m1iR4Zv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764688053, "uuid": "72a3b5c2-e300-4ce6-b611-16947c4a7068", "value": 58848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764688053, "uuid": "f5816fbd-b4dc-42e4-b725-71ced333eac4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764688053, "uuid": "d43965e0-61aa-4ab7-8bfa-21ec00938ef0", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c459399-cf58-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764663886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764663886, "uuid": "2086ebe2-e87a-4799-bb01-3868e4069226", "comment": "Malware payload", "value": "f1f51019faca9bbe41b6bee334bd19c4", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764663886, "uuid": "85701c51-b694-4a81-a9f9-9e589415301d", "comment": "Malware payload", "value": "7ef76857454ffa30e69c5aeed1307e958b2b9bd45e9855a9cdb62cbb42aefbc7", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764663886, "uuid": "84cd4346-24bc-4894-a110-66d24082ef44", "comment": "Malware payload", "value": "09bc1097b919077d41ddaaa6c6a58b9e22b77e64", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764663886, "uuid": "1d9aa097-6e6e-4f54-ae6d-3a399cbcdadb", "comment": "Malware payload", "value": "9a46e1375c0eef9596d7b0b20f2bd7ddb44f5aa0cc0cf65c6faa56f53de9550d9ac80c8443c6b1921419f8f2830e9481", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764663886, "uuid": "09696277-6e58-45a8-ab0e-7fe34ec6da6c", "value": "T1AD461287F705A87EC0FA82364536067655678C2A8F83D7831A5D373C59BB6C84F4AF88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764663886, "uuid": "c31ba5c6-cad0-47ba-8e8f-8ac78c322720", "value": "98304:WWRmazWzxr3WWgB83MDyPlyyTJlzsHcCWpFbvMfEh0RArxPKHwHB83Hd:WWYaRi+yPEyTJdggxPabXd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764663886, "uuid": "3a010249-fc86-4907-9c77-8595c7385351", "value": 5393565, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764663886, "uuid": "1a5d7114-cdd5-4a54-ba58-a086fc8542fd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764663886, "uuid": "c955553b-1b83-4627-b2df-86e053a940be", "value": "ACTED.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a63bc35c-cf90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764688061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764688061, "uuid": "0e0b48ab-eb9c-43fe-98b9-07035fb37260", "comment": "Malware payload (Mirai)", "value": "d0d924092047590133a656a49ddda7bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764688061, "uuid": "90806e3a-9eb6-462c-ab19-81c2ac450481", "comment": "Malware payload (Mirai)", "value": "7faf01fc17dd864bc4d913170fcaf99aebed69c64808919496d384403a910f07", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764688061, "uuid": "e42b5fcf-38b0-4503-bd96-def9904223c2", "comment": "Malware payload (Mirai)", "value": "aac12104ea043eb61d8ee8e9a30007790050beb5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764688061, "uuid": "7e07a2ee-6377-47d4-bcc5-7762916ecdfa", "comment": "Malware payload (Mirai)", "value": "262037c42d6d6c7d57ef43fe1725ef9608a8c33dd3a698f19cfae12800ab63385389c4967f38a3eecc01fc742a7fae23", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764688061, "uuid": "fb659cdd-7473-4894-831a-7c99c5a10248", "value": "T1DD4309A8F54386B6D887057424ADFF276E31A2E57398E903F3F552B27CA2143A805DDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764688061, "uuid": "34b32114-124d-4261-b338-092292553125", "value": "1536:Y62E0R9omcp6Z5c1YNG3NH770T26v2okQVdbR0Mg:Y62Domcp6Z5c1YNYF770T26v2hQVF2M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764688061, "uuid": "eba937e7-2d51-40dd-9a1e-2dc9df76e2b0", "value": 59888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764688061, "uuid": "5469aa94-f667-424d-ac1e-76d99ccb17b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764688061, "uuid": "b39fefa7-1cea-4941-88c6-0d44489df3cd", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72f1a644-cf3c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764651898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764651898, "uuid": "345d155d-26be-4cda-8ff2-58472253a368", "comment": "Malware payload (Mirai)", "value": "8556e8699d5fb3094458c929723abeae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764651898, "uuid": "ef7bcde3-3e2e-4d40-b0c7-989a312c196e", "comment": "Malware payload (Mirai)", "value": "7ff93c711fb0c8adc67900a01b0b939987c5c73085d8385cc29c02b178f4a324", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764651898, "uuid": "0b9237b3-3e08-4959-b3c3-4c8541889cb4", "comment": "Malware payload (Mirai)", "value": "e3bb68eb99882ae7c56af8ac0dceac521dfec8cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764651898, "uuid": "19bd054b-2ec7-411d-9311-48034b52ab6c", "comment": "Malware payload (Mirai)", "value": "3a8076ca632e0fc0ba34e8fa742b98d0ed55ba19a4aef37c94aab1d80f993c9fc1919b32402a9c5cce0f949e9cc9a9b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764651898, "uuid": "b4d796a1-832e-48bb-a43f-b0c788fc1c81", "value": "T18DC4394ABC908F51CAD53ABAFB5E82A873574779D3EA71059D140B3437CB89A0F3A701", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764651898, "uuid": "6b59b6fb-dda1-4145-b8fd-44f06d40abe1", "value": "12288:sS4QgtUaTZoiIfbe789ATkk4VUcJxAHF648/JWVvprW7Y8aif93cJw3VbEojdktQ:sVtUcZoiIfJJMBUYYldktJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764651898, "uuid": "89247b72-81aa-479a-a72f-bcc762220ae6", "value": 566816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764651898, "uuid": "37fb351d-bb9e-4182-a66d-a5a5096458c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764651898, "uuid": "5152322c-0060-4b28-87f8-f97eb9bbf3b8", "value": "sync.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "581e338a-cf3b-11f0-a129-42010a9c0007", "comment": "Malware payload (Kimsuky)", "timestamp": 1764651423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764651423, "uuid": "c5680a59-5a17-4924-a125-21f56f51789d", "comment": "Malware payload (Kimsuky)", "value": "903cec93146327414cbc49068c524292", "object_relation": "md5", "Tag": [ { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764651423, "uuid": "f71b1ea9-033f-418e-a067-632df153c8ad", "comment": "Malware payload (Kimsuky)", "value": "81e384471fcfa6752cb81ca1b7b9ee455cc78f1580d260ed7a11d682a378930e", "object_relation": "sha256", "Tag": [ { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764651423, "uuid": "da32fef5-9ae7-49fa-aca7-ce4f68cba0d1", "comment": "Malware payload (Kimsuky)", "value": "f752fec87877fdf366dda38313e3f83853eb9d90", "object_relation": "sha1", "Tag": [ { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764651423, "uuid": "7691faeb-ada9-4ca6-b533-78f6c476803f", "comment": "Malware payload (Kimsuky)", "value": "7a66bb90ccf5d8ac5364076e137c7fa577a68758b6e4c267618ffd1cf868665b9f0d40ffb58366ddf4942acf173aa0f7", "object_relation": "sha3-384", "Tag": [ { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764651423, "uuid": "2be2809e-661e-4af5-99cb-1fe5b5419a69", "value": "T1AC36F111AF846F9EB78D0D57E0BD6A0FA7F31B84D0B3B1CD67923603258EE1C9619858", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764651423, "uuid": "f2be0d50-c8a0-49b8-9b98-0651ffb80e45", "value": "49152:yTFqC7emrxxnsv7Dp3nvYpohCP6Yg/qZI8VKj9+vBvGXTrFyTFqC7kTFqC7A:o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764651423, "uuid": "214068da-3f54-49ad-bea6-e111384b44d4", "value": 4899895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764651423, "uuid": "0fd2f531-d64d-4011-9be9-10157aec3e8c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764651423, "uuid": "327e3f4e-896d-4926-9027-83e4247fbe38", "value": "81e384471fcfa6752cb81ca1b7b9ee455cc78f1580d260ed7a11d682a378930e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcd165d7-cf46-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764656370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764656370, "uuid": "caac593b-3489-4d1b-8f12-6e9ea45f6ccb", "comment": "Malware payload (Mirai)", "value": "cb15e689bd5574bdb023e131d82d6527", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764656370, "uuid": "9d72a3f8-3496-4832-a23d-37b3eb7e3f0e", "comment": "Malware payload (Mirai)", "value": "8205bacdf22b3d62559690acb19fc65bd03c5ca7ea1fc4e2eec6168047d2b5ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764656370, "uuid": "05cc6141-90b3-4c6a-826a-0df13d17aad4", "comment": "Malware payload (Mirai)", "value": "b80c8fa012565f028b4f12881ebdc49265039420", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764656370, "uuid": "e2a2c305-1e1e-4aad-9709-ad4533cd03df", "comment": "Malware payload (Mirai)", "value": "189f538659cee0c8acea0321176316b5ced63c6989ad72e065819624b0dd797ff462efd63f04db8380395c6e422b45af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764656370, "uuid": "be8bbc58-1fd2-4d4c-976a-5a895d28cd08", "value": "T1AB73B309BFA50FB7EC9BCC374AA92712288D651A35A93F35BD34D418F25B21F15E3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764656370, "uuid": "ea1cb398-273f-4938-bc73-091e0bf36413", "value": "1536:aHJtIFGq1QuT+uDEQhKvt191Yi8ZNFDGN:aHJtIM0T+UEQPi84", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764656370, "uuid": "ba47c7b0-1c01-4000-aa67-b39ac0763e3b", "value": 76904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764656370, "uuid": "b3ff97f9-60c1-4964-9209-507ebb954e51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764656370, "uuid": "1f1f624d-e112-40c3-996c-e8572582dba1", "value": "jew.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16ef3e4b-cf79-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764677943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764677943, "uuid": "de54cae9-f4f5-4498-a666-dfeb5ec4fe46", "comment": "Malware payload (Gafgyt)", "value": "5e8f425536ae9ffeccd0b442452d296a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764677943, "uuid": "14a0c2e2-53fb-472e-a401-26e1a4bce21e", "comment": "Malware payload (Gafgyt)", "value": "827c77a9fbb71e8f818124232fbb29adb69f1286e9399614e31d4122f8579ff0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764677943, "uuid": "9c6cfbe5-4138-4fb4-aa42-d2411a408e15", "comment": "Malware payload (Gafgyt)", "value": "1242fb9e19d028d8498b5d72845d2c6cc77ee6e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764677943, "uuid": "e0fdf34a-ce08-4bbf-bdb6-0d240d0a50c6", "comment": "Malware payload (Gafgyt)", "value": "5057121c2051524b700d952747765fadc2cf77b70cdba2389e5600e85582d7e9921167e10dc543dae47302fe015c94f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764677943, "uuid": "4182ef3e-e48b-4526-b37e-6451c0cd922c", "value": "T14AC33C09FB404B57C0E127BAFACB424D33238B54779B331A5A289BF43FC6BA94D26515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764677943, "uuid": "9d2c64bd-b85b-4085-846f-776f187372d6", "value": "3072:GnLzxf5P/m6YFSGub/biEag6CM/98InpT8dz:MLzxfl+6YFSGk/bagjM/98CpT8dz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764677943, "uuid": "fd2f7999-6490-420e-9ec9-1cf403e8dd45", "value": 118402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764677943, "uuid": "1bf0f9a0-4107-430a-b12c-130da05d616a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764677943, "uuid": "245cd98c-78d1-4283-9c67-a126721b488c", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb1b35a1-cf3c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764652019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764652019, "uuid": "713724ee-27a5-4e10-9ff8-d5a251df3a08", "comment": "Malware payload (Mirai)", "value": "8d2379b247d00c010556690a80b120cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764652019, "uuid": "080385a2-b2fc-4a9e-b3ec-4c4c3db9ac3f", "comment": "Malware payload (Mirai)", "value": "8296eb708773a85e34092d869e270a3566695b51109417d64196e6c19cc44b5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764652019, "uuid": "b6d470fa-d8d9-4d87-8e04-4617ca3990a4", "comment": "Malware payload (Mirai)", "value": "f2d67d4ca5f5d9d69f537c20ead356056449db78", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764652019, "uuid": "93704a7a-c3b8-4735-97e5-b19bc7acd4e3", "comment": "Malware payload (Mirai)", "value": "779fbc0a845c9621a3e92af5cb0910894961390d2e181e7aa58ba8eae77a7afe4b3ab69762734daba00eddda44923354", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764652019, "uuid": "14f3200d-a8b1-4fa8-9906-eade2bf7cd66", "value": "T10563020CA54A53F2F96C77F79A69C791EA3CD8379902B31C11452A685C6EC5EB288082", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764652019, "uuid": "37077ff3-3b02-4573-af98-90e619e97a47", "value": "1536:u0oce2Ii5ehAgfxvW/+erzK4pUN1HXozJaU4u9D9xXQN0:4ce7TygfxWmerzKAUNCUsD9KN0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764652019, "uuid": "8557d34c-d719-4759-800d-665b23f40990", "value": 68748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764652019, "uuid": "5878c454-a927-4ac1-b25b-54ba58ca691f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764652019, "uuid": "196a34d7-9753-4c5f-a44b-95d8e7fbd51f", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94a93869-cf5b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764665269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665269, "uuid": "93a0626f-814a-40cf-9100-707dd9573005", "comment": "Malware payload", "value": "710b9921b80c31014447e15127370dd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665269, "uuid": "b906b476-0abf-4cab-907a-91768bd41ed1", "comment": "Malware payload", "value": "8322cf25135307d43fbe33f4e9f729ec29a9770303741d2a05532cb8cdee664a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665269, "uuid": "b715a879-0d9f-42cc-b8ad-d8a66aab7744", "comment": "Malware payload", "value": "863f9648f8d0d1719ac8f999125a1fa2cd6c3b88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665269, "uuid": "a4df1e57-bde1-42d8-9de7-526b09d8a4e9", "comment": "Malware payload", "value": "aa8a6f6f29ce66e3850164e7385f39df9be7f6b17e015c7ed373fd830368dce37270d46d1a8451c80db80051b780fd9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665269, "uuid": "0cc20d29-7979-4f2a-bc59-7b08e9608760", "value": "T1C574120532A1C013C46307704939A7228AF7ED667C35A39B3311BBCEBD76651AA0FB23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665269, "uuid": "605677a9-c205-40e5-9fa6-902309bb5cec", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665269, "uuid": "f90ddf0f-dcdf-492e-9324-a84f5690f4f6", "value": "6144:7gORaLu34zp1SG3UyEW1ikpDbeiGk1dMY6+8XV/D7BM1F5d3P7K1mcOI:7gfN6G3lE4iSDbzlqY69XF7B6jd3P7AL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764665269, "uuid": "1c7ab896-ca61-471d-ae89-8cbc2ee4b98d", "value": 365696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764665269, "uuid": "b2460ac0-de5d-4ac3-be6b-018181f306f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665269, "uuid": "bc4c8294-d18e-471f-83fb-a5df5d22be00", "value": "Order Confirmation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58958812-cf61-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764667745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764667745, "uuid": "a6cb9fc4-c097-41ca-a4ee-1c51b13e0622", "comment": "Malware payload", "value": "486362b3ece5ff2aa46dadef917ed814", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764667745, "uuid": "cd43eab3-f6c3-4cce-86ad-b01218853acd", "comment": "Malware payload", "value": "835b863c5447ef751c126339932347a801c84dfc8ad05de231f44e8de88175b1", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764667745, "uuid": "0481d8a5-e83a-4314-b7a8-fa9c957fe3a5", "comment": "Malware payload", "value": "f88d1295bbffc0f46592330e2c23aa9f220a495e", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764667745, "uuid": "2c1d42c5-0401-48f6-9ce0-cbf9b7bf101a", "comment": "Malware payload", "value": "37e339cba76d14f75acb7fcab2416ce305d83bd6b01f27ce99ac6538f625f5844d047ac18d86917ec6d0228a58129931", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764667745, "uuid": "dbae6b5e-1d76-4299-8061-e98cb3d06c3e", "value": "T11ED5336FD758DB8C7F3BD4E6758363345ED88C2073CA94C985D77B78A0A7200AB58892", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764667745, "uuid": "171c05ea-928a-4798-80d1-6d6b672eed8c", "value": "49152:bNYh12N1rB/luwaaskW3BljzUx9BTvazHDqB8LI17K/BCuf8hGYZb2+ypLwlkVxM:RYmN1t/ANWaB6jBOzjQFhGN+blGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764667745, "uuid": "e06ba77c-e09f-4f50-9890-7c272ad3bb3f", "value": 2891656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764667745, "uuid": "7330d9ec-34fb-4632-a474-d259dac578d7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764667745, "uuid": "9eb0e65d-fbde-48bb-8841-524cb7ed3ef9", "value": "PURCHASE_ORDER-PO-664735553_pdf_doc -.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07e80f97-cf94-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764689514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689514, "uuid": "c2c010a9-60d1-4b9a-b4cb-f2b69be87e7b", "comment": "Malware payload (Mirai)", "value": "23b43b75dc6752c329072c91ea0d711a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689514, "uuid": "64a10728-fc36-47ab-8c11-2e2e3244c40c", "comment": "Malware payload (Mirai)", "value": "84c848f18c5c2e40a44a76203acd87ad00ad86f74834102120361738ca742b75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689514, "uuid": "e2609f16-6960-46e6-bdcb-3307ad40e325", "comment": "Malware payload (Mirai)", "value": "ee70171fdccf0f6ebc1f45cb0fe0f3b213b2477f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689514, "uuid": "a53f7f1e-e351-4f65-ace8-299117b70e52", "comment": "Malware payload (Mirai)", "value": "3f48e4b72037bff289189872200f15955030594863ad3fcb2e794721b47de12772c3159888624e7676f2aefac8166c07", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689514, "uuid": "f3794666-f897-4b16-88c2-78f82ea87c01", "value": "T166730287C7BC8A42C47AA07A95A2FCD70023649862F3A1C76FC69CD19C35F7A2905BD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689514, "uuid": "a8ff1a27-27fa-4187-8a2b-5effe3800122", "value": "1536:DLGFhuaVeHif6K8GkMLqs5TsqLK0ix7AXPIg+y1cQm9/XFxUtebgHdnouy8Gy+:Dwh3ydM5K0ixA/ImdmxUUbgFout6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764689514, "uuid": "0775f672-8705-4f4d-82b9-d911978992a3", "value": 76444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764689514, "uuid": "a8f44206-ddbf-4f71-9db6-d920f667b156", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689514, "uuid": "a4fd8564-d3b5-446d-beb4-a8bd7b7ee6b2", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1abddc1d-cf49-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764657333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657333, "uuid": "424918b5-10ac-46b6-8506-d27d06183815", "comment": "Malware payload (Mirai)", "value": "f5e9b1aa1d23e208d6843b6c327db53f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657333, "uuid": "8acf7cbc-4752-44e6-8cb4-ba622587e19f", "comment": "Malware payload (Mirai)", "value": "8532fa5b1e85e663722655e158d3c5439f0749dd1925744555ecfb2d4f5848d0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657333, "uuid": "4430c1d6-b82f-4820-843b-4de06a97f7f0", "comment": "Malware payload (Mirai)", "value": "724263f9b92b261261829b9befb7705b44e90a28", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657333, "uuid": "81abf93c-8d9a-479f-a1fb-cce6dab5a622", "comment": "Malware payload (Mirai)", "value": "921fe974b1eba6b6f07489617e496bee7d3a7bce9dd403e32460c43bde7eb87907a0cdc9412da2fc394eb12afa0c9459", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657333, "uuid": "bedc4a97-b429-4496-add2-b74bebc3b5bb", "value": "T19B1150CF01D56D311C53CEB8BB534C196A85C5F065D7CE88788E0957B08DE043899EB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657333, "uuid": "7f9e592a-74a6-4ce4-bbab-1d29e4d57229", "value": "24:g7mTa5zqwt+MB0rmkJ8JnkJwkJukJyibS8kcn:Ej5XEA0ykJ6kJwkJukJyibS8kcn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764657333, "uuid": "8cf3d4c6-1dbf-4dc4-8a66-b562cac1098a", "value": 1035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764657333, "uuid": "d2b00c75-53e9-4a0e-9341-aa3df4be1691", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657333, "uuid": "0d2af5c7-8843-4da5-8525-5a38de6b81af", "value": "kkk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ed20fc9-cf45-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1764655810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764655810, "uuid": "fcb1e73b-2019-4d4a-8603-5593feaac2bd", "comment": "Malware payload (RemcosRAT)", "value": "6ad6b8e8dad4f6555786a44725800fc0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764655810, "uuid": "0cec0180-6eb9-436f-8b28-4fa7d19067b1", "comment": "Malware payload (RemcosRAT)", "value": "859ffef0278c9c9835db23202f3aa67b69ad1e00a3f326350f613ab701a45ee3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764655810, "uuid": "f6fa521c-3547-4c05-b8a7-7592072bc06d", "comment": "Malware payload (RemcosRAT)", "value": "9825f7f799d765eac6a9892f278aacead54b23cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764655810, "uuid": "e7e1c02b-19f9-4433-99bd-05e03889be64", "comment": "Malware payload (RemcosRAT)", "value": "cbab8c3f8e2c9e9eae446f513c64152885e0dfa000b007bb4bd836d8b551b7e24de2691965c64d98359fb6d30fd1bc39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764655810, "uuid": "e024c8a7-86cc-4631-800a-c57509cbf447", "value": "T1E8352221331DE017D46A5EF04862D272277E6DAC9D02E54BDEC83F9F78EA3164A50B93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764655810, "uuid": "2b1f201f-8085-423e-bc0b-257d143f4623", "value": "12288:d60BBCdnT5W/VNf9hZnLtOYU/Wjd7lV+nZJiTk6+Fl5/O0JnCBDoe8wklzEHZq9o:fm94dtUczV67iycWyF3kuHZq91OJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764655810, "uuid": "ec09c350-7d36-43c4-9b0a-fa733a83c7ef", "value": 1069056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764655810, "uuid": "9d36a140-3573-4d0c-b9d7-6ea19acabeb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764655810, "uuid": "11abe531-56df-4254-aefc-37f754da0462", "value": "9Oi8Y2XXM3SzIv1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28e1383b-cf94-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764689569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689569, "uuid": "61b26af1-fc47-4937-95d3-c4e9e864bb08", "comment": "Malware payload (Mirai)", "value": "7db889c6c8f486036026edc8417fb324", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689569, "uuid": "46e80dfc-d69d-49f3-87c7-ab77ad807245", "comment": "Malware payload (Mirai)", "value": "86847bc32db03db07ef497822a1fb9fa207bea75f0ce92702823c52b3dc5e3f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689569, "uuid": "9714e474-7249-4dfd-a123-53f54738b362", "comment": "Malware payload (Mirai)", "value": "3a3b6bde7456fe865e80e4f5f153a3ea5bbb99bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689569, "uuid": "9744e4a3-4e14-45b9-988e-5f0e0e559660", "comment": "Malware payload (Mirai)", "value": "0942c6fbbbaeee738c04cf1128dc27f272c3f639b293a1f50e392bca327c4f72fa6b27b8b1c1e91ecfb369d7fd2edb5f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689569, "uuid": "64db030a-b723-40af-bee8-7f8272516d23", "value": "T1DB345B02732D4903D1D72EF0373F97E197EFD98220E5B641299F9A5E8176E321849ECA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689569, "uuid": "b76825b7-a504-4bf1-aef8-9c3cbc6bb660", "value": "3072:BZeTdhrWLKZSIJtAqs3EZx/DNxY89f/bmj6ykUZcMc0vL:BZEjbqEZxbjYuf/Sj6eZntvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764689569, "uuid": "21c02018-8d7f-45ad-8245-0e5a9898cfa7", "value": 240676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764689569, "uuid": "63fdb411-fd31-4031-9e47-75cb643994e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689569, "uuid": "10b02da4-fd43-49f7-a490-a265ea28eb15", "value": "ecco.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "290acd14-cf45-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764655639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764655639, "uuid": "a2e1a3c8-7203-4232-af99-bc1674cba61f", "comment": "Malware payload (Mirai)", "value": "833d19c7cfbf5a72d1f0656f83491562", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764655639, "uuid": "86f1b7af-e51b-407a-8d78-868b08a05c16", "comment": "Malware payload (Mirai)", "value": "868590dff7b2415f195e31ef551bc400a76c79e737b4096d4691a40df2e053a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764655639, "uuid": "dfbc2bd1-301e-43ed-b537-9ae7e3560db2", "comment": "Malware payload (Mirai)", "value": "3b1a5c67c82356ac85ff79d6d1c30c9c69557476", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764655639, "uuid": "a46aa242-eb64-44d5-8683-8f1d84e8a68a", "comment": "Malware payload (Mirai)", "value": "80b56c08d3b8daa10c1ba73c52a125b0a7a02f309d7bea708518f5a8a750f9b4d45296318dd39412a4e8aa9c1b4c0566", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764655639, "uuid": "1a582b7b-7de1-4c21-997b-4996f3215ef9", "value": "T191D3CF30E064ACD2DC2009B638B99AB80750AE7013D65492FFFDF95BA877D4878AD271", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764655639, "uuid": "358f2ee4-bea4-4f12-aae4-1685f033aee5", "value": "1536:K8OvJe1wg2tdliUMXf2S1q3k5skqEVOnzDU6h334ZfG9emnOoLmn/GYmA+g8u0r:K8JGdlcv2H3GyEVOnzDU438G9XhLour", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764655639, "uuid": "895179db-8bef-43a2-b390-e4f472dbff26", "value": 131708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764655639, "uuid": "f428c996-2433-4e0f-8968-70727c55e09f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764655639, "uuid": "919a461c-4778-43f1-8448-17912c57fe00", "value": "xnxnxnxnxnxnxnxnsh2xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d1faa2a-cf90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764687992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764687992, "uuid": "6b4c5e80-3026-4ec6-837f-4c34b40f97d3", "comment": "Malware payload (Mirai)", "value": "53901eb963b4f48a1a8abc23d3e14362", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764687992, "uuid": "7375601e-f278-4124-b07a-5685abd1f3ba", "comment": "Malware payload (Mirai)", "value": "87c5cae1999e278e79bc9255af80ed64fbf8403049b34831a3737e824dcfc86e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764687992, "uuid": "4076f73b-50fe-4c01-9f8c-de3cf0976f47", "comment": "Malware payload (Mirai)", "value": "3e2ca7cbe15f89ead8e9bf115cc674df237ef980", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764687992, "uuid": "35d9f269-48d1-4f2a-8034-0d0b95ec9323", "comment": "Malware payload (Mirai)", "value": "20809172b21c9027ad68b3b935129d366260fb0fb886f5b7679b2e4df491c595cb0d0a10bd135a0d457a05868b7b1d4b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764687992, "uuid": "4263ed1e-b226-4de1-928f-49e3414fc34c", "value": "T17A431839F01A5AA2C5874134709CEF762F22A2C46386BD7736F142F168A3857BD15FE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764687992, "uuid": "a19757a4-9c4b-4300-9974-ed4baf5c07a7", "value": "768:bdaZ+9dBsCeRs3q7eqtNLrSIfYat6l5b89YJ9CnoHgj4OCr7w:ZaydV6pV5flQFJ9THlOCrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764687992, "uuid": "671a6b45-30bb-4271-a519-f0d9d5a009f4", "value": 60472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764687992, "uuid": "4a6c5adc-f966-4e60-ada7-90c30cf40915", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764687992, "uuid": "f7a505ab-e60f-4296-9c21-12989abba3e2", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8732409f-cf38-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764650214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764650214, "uuid": "1888cf73-8b84-4d20-a8d0-05768e9f3fab", "comment": "Malware payload (Mirai)", "value": "2e12e59969f3e94f00bf84e088f7ccc4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764650214, "uuid": "684fcac1-152d-451a-a6e0-206ddf4b9c61", "comment": "Malware payload (Mirai)", "value": "87cceb886d83c41ce43760e7dda53a11e156880a21c77b7fbaa08d02546bb672", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764650214, "uuid": "9142b0ef-2ae7-48ee-9710-b23b45e046b4", "comment": "Malware payload (Mirai)", "value": "59d2d50627521fe26995ab50934e559dd0660d0b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764650214, "uuid": "fc19d9b1-162a-4e58-9241-41850557f4f0", "comment": "Malware payload (Mirai)", "value": "ea2679a042f59179d20b462929bb9fca6813caca05898f270d44e4156aab12deb56f023af49e188e00fe4af16f29978e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764650214, "uuid": "cafade88-21c2-48e4-9543-a9f217245f17", "value": "T1B4146C2BB3C3ACEAD51063305C312362771FCB051914EBFBDA1B3794A99B7225A246C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764650214, "uuid": "2a358aa9-7135-4436-b477-77ed4a407a23", "value": "3072:ttBOm515aJZymQH7L9m5QH4bOs2SQlkAmDMk+PtHFbb/Xs7IKZ5tT:ttBOm515aJZymQH9K2ZdkYb/c7IKTtT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764650214, "uuid": "7d058998-0bfe-44ee-89c1-9cb3d0d8c99a", "value": 197448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764650214, "uuid": "c404d639-2b07-405d-9717-36ccab254e67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764650214, "uuid": "a6455c0a-868b-4bfc-8675-b212f31a4fc9", "value": "xnxnxnxnxnxnxnxnloongarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd756d57-cf46-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764656371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764656371, "uuid": "a9a148d1-8610-4d23-aedc-0d64639819c2", "comment": "Malware payload (Mirai)", "value": "4904cd9002924f2039b4c10eba0b39e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764656371, "uuid": "9cd9e4a3-9246-40b0-8cce-0c2075171765", "comment": "Malware payload (Mirai)", "value": "87d6a56cb12f6cf427dd2d6f978f3e85a966851f6aeeff54eb8a8084bc776f7a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764656371, "uuid": "adb45206-1dfb-42ed-b692-1993d308a1ac", "comment": "Malware payload (Mirai)", "value": "c57a241476017c662ac31c9d5fd564e1fbf2c6f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764656371, "uuid": "17051810-ca5f-49d2-b471-e6322eb5bb67", "comment": "Malware payload (Mirai)", "value": "cb8b242d0fa040c8d18f93665a6ec36eea4b2b13c49c505087bb5cdbc7bae2e9378ca23846822affe2d13058e2702020", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764656371, "uuid": "4a673a57-d7d5-4cfc-b3e3-4dd72a9660cd", "value": "T174435D43321C0E47D1A25EB0253F17E093BFE95124F4B689265F9B5A8B36E3B1486F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764656371, "uuid": "980b334f-50dd-412f-8125-258882c8d81e", "value": "768:lgbf8RQzh1r3FgzRaN7+faVt7Ymuiygu1HoGczEpGVuz2GipH6TnSgGABh:ybUg1Jgzz4Cqu1Hisi6nSgG8h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764656371, "uuid": "38feefdd-0ceb-4110-a359-77558da0687e", "value": 55472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764656371, "uuid": "bc1d2fc0-5b42-45dc-ba59-cfbda763482e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764656371, "uuid": "ba0e7f84-4005-4ca2-8df8-d2d4bff13480", "value": "jew.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dec60943-cf70-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764674412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764674412, "uuid": "d3b70211-63a7-48ae-a5ca-402b3bc7b992", "comment": "Malware payload (Mirai)", "value": "7ac8fb0af15d85d3f3452ffa96dbc978", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764674412, "uuid": "83c83192-26cc-4557-9ea6-a3887addbb87", "comment": "Malware payload (Mirai)", "value": "8805f8a5185d4104a9adc7d0188a149201d580489eeca64f8acc978d195bc638", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764674412, "uuid": "4705f9de-8efd-4e5d-8c52-36c2bde5b4a9", "comment": "Malware payload (Mirai)", "value": "c1588d6c7ecb81ae0bb227aefe163c0b23d6f26d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764674412, "uuid": "c40a80f4-e23f-4224-8ca7-34e49714aa3f", "comment": "Malware payload (Mirai)", "value": "0c25b9c1c56b85602445696fc09a08b380e89cc571c403a4c9a734f51eb818841a2fb2ccda9423b3b0f195be5c7f1e9f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764674412, "uuid": "0e8e0476-3062-4d1c-86f7-5234dfdbd9ee", "value": "T1B363021E06A0F5CDDAC984BF91C065812FF04BE3B256EDCA2A2C50D7E8DA0D51DC59C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764674412, "uuid": "ca691fe6-d4c4-488e-810b-d10c84f61585", "value": "768:85IZLMKk1m4samiDMy/g/ZWUThm8F6SbHL0h2KpszZuwk5xMTyrRb5/MO/lNO4V5:ywygy/gLEPhrexkx+yrRlv/pPVJuU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764674412, "uuid": "4446c7a1-ebf8-41f5-8e47-f7cae7696fa0", "value": 67212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764674412, "uuid": "3643709e-a53d-499c-b3c1-bf2b920455ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764674412, "uuid": "e1937f02-ddf4-4d92-ba6f-c017550e8fe4", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dd4ee3d-cf5b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764665257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665257, "uuid": "070e6b25-ad37-460a-80c9-0a8f5178a733", "comment": "Malware payload", "value": "39956655fc1613d213f9ba951e0f1b3e", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665257, "uuid": "c7466991-f68c-4c11-94e5-7ca30e77b0f4", "comment": "Malware payload", "value": "897f495c69daa27564a121aa2483d7eddeeb388cba1634ea304efe9bfda32f1a", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665257, "uuid": "88844ac6-4208-42fc-9248-c59d78fd41a1", "comment": "Malware payload", "value": "7a73f09ee82ece69171012c1104ba071fc820aa8", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665257, "uuid": "0d7ac781-2558-40b2-981b-22f8c1832dd6", "comment": "Malware payload", "value": "a9097fffac56ee9d206900437c7e0b4b06d7158a3238c658885caa550238cf4e8866886ad7991059b9b1035eb4cfb173", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665257, "uuid": "ff75f05b-4904-4b3b-b2ee-5acb57a1e1b7", "value": "T13214734062C1B8A4C3971A76771FB8D5FD3B04D93498498BD129FD90B7B5B06EAE0B32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665257, "uuid": "5862ace7-d635-4a8f-8b14-6dfee7d028ca", "value": "6144:dbTBdkiWa+7xrl+NU8HJBeSZ9W2tJkatDo+tvOmenvLe:pdOiwMU8GatDo+tvOmenv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764665257, "uuid": "445f188c-db69-447e-aa33-d1a83f878c72", "value": 204800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764665257, "uuid": "3dbf9fe9-3d2d-446a-9e11-674522e21ea7", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665257, "uuid": "e0741b38-e4fb-4256-86c8-5b1c64a37ba7", "value": "Waybill Number_0045643890.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c3841ae-cf79-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764677951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764677951, "uuid": "e8892dae-f2d7-4b3c-8961-27b3ec20450d", "comment": "Malware payload (Mirai)", "value": "2b38264139f1ffbb6fb9e139d8bc7833", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764677951, "uuid": "7b636bd3-df81-40a7-a29a-ed50162a8a6f", "comment": "Malware payload (Mirai)", "value": "89f3c18618c3216a941199566bf421e166b2da3ee593c409ed669a804cb192b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764677951, "uuid": "e43f8c1b-3894-4d2e-9e94-749e58abbef9", "comment": "Malware payload (Mirai)", "value": "126497a0c07554b89a5a4a139f7700b4e66367a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764677951, "uuid": "cc918253-4b0b-4ac6-a97e-bba7efe9a1ff", "comment": "Malware payload (Mirai)", "value": "06ed1757f39d8b9e11a28a2f3c770f6855f381fbe7087da69c81dcef5d4ecfbdbb03a4a9d80cff6a68f073b57f575572", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764677951, "uuid": "601c87f6-4a13-44bc-900b-609c89c55a82", "value": "T168044C21B8392D27C0D0A57B22F74721F5F2639925B8865E7DB10E8DBF143C02B56BB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764677951, "uuid": "805bede8-8c21-4ea5-9923-8fe004a60fe3", "value": "3072:75n8UDQxVaFQkL/c4/3B9KYso9Ip+/cuuoajS:75reVaFQkDfB9eaI+cuha2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764677951, "uuid": "e6bfd9cd-86b6-4eb2-b9f3-e69f0fa5e7e1", "value": 174308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764677951, "uuid": "cfdf74ad-1d49-4263-a752-ad10397762dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764677951, "uuid": "ea2889f6-3d67-42f3-ae60-1ad92abc1355", "value": "morte.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b26054f-cf5b-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1764665253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665253, "uuid": "e31db974-79f9-4f86-8f2b-21c8c060cdf5", "comment": "Malware payload (Formbook)", "value": "3e53cfb7d979edb8b26fb2827c4428d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665253, "uuid": "951b1f51-7bd3-4ba0-b736-0d1f5e955660", "comment": "Malware payload (Formbook)", "value": "8ab637e2cb18c2cd0e1a8e8458916f356f42a0579aa9f1fc522a52056402f6c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665253, "uuid": "00543b35-ddf4-4cf3-a381-bf2c160ebe38", "comment": "Malware payload (Formbook)", "value": "e97771cd5427565357b864e1131e646165381616", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665253, "uuid": "edf7ba75-cca4-4345-8e82-1078be82edde", "comment": "Malware payload (Formbook)", "value": "cbdd6dc6490cb5615b482d2b4fde07a8d6b7efa1a1a4bc1e2647a4562c58de9e61830c396881ea163a12265c07c0cf73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665253, "uuid": "2fd1a81e-a217-47e6-9973-31bc671a2f65", "value": "T1E3D59D15A39006B4D82BE674CAA78333D6B1B8524370C24F2699D70A6F37BD29B3F715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665253, "uuid": "920c6bc2-6b22-4dca-add7-96c0e589fcb6", "value": "928969f4e86d2076055dd81212337225", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665253, "uuid": "01f154ca-c1f4-4e15-913b-d8bade09a093", "value": "49152:En35cTUBUatv7bGUGR9SxyW2KluojxgwuPSpnjN9zPbK:En3qatzC4agjN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764665253, "uuid": "493785b4-d5d8-4d2f-9acd-d96cbdb53007", "value": 2936320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764665253, "uuid": "589316e8-3605-4b43-97d1-3a91ea4d164a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665253, "uuid": "cd57fe0d-4914-48ff-83ba-0da44173afc6", "value": "libcef.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5160e01e-cf2f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764646258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646258, "uuid": "af73b78f-9f76-43f3-a394-746a35f201f5", "comment": "Malware payload (Mirai)", "value": "73fe74e5d890160c8d2fe0b7cc3a19e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646258, "uuid": "704dee01-aa77-4fbf-8a52-4ab9d31af21e", "comment": "Malware payload (Mirai)", "value": "8bb515f5ce0a713ce1226aed420d0d70786761a2c93e5c70f542aa126a83fa38", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646258, "uuid": "050c801d-415a-41dc-95eb-ef1a526403ee", "comment": "Malware payload (Mirai)", "value": "c2bc6df3582bf664946749e37a0a341193719b43", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646258, "uuid": "0d1248d5-9a45-42f9-8498-6f3c7e7fa4e4", "comment": "Malware payload (Mirai)", "value": "bd8078c1b6e137eab675e9848883ff61839e43bff3834255d66a6ed80ca78004387b6e107b8ef20b274d8ed45f7f3a09", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646258, "uuid": "f3848a69-b955-40c1-a86d-525ea45e4d5e", "value": "T1A7731A45B8818A16C5D813FBFD2E018D332667F8E2DF7212DD105F6477CA92B0E67A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646258, "uuid": "f369ff7d-a11e-493f-8ad3-ff1b5cee3f88", "value": "1536:eNn8UxkW50thqBtIC1R4/LsdH0ZBYSSZvNNSVzfpnDM4ioyuuz6xd42+:wxkW0hCtIUOSqzgjMbyuuz6r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764646258, "uuid": "d24689eb-5cba-4bad-a686-174dc4c01b9b", "value": 75056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764646258, "uuid": "b92c22a7-76fd-4323-a56f-696f3b8a1e7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646258, "uuid": "dfa493cd-320c-4730-b776-b6b52af8e014", "value": "jew.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2746ded2-cf94-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764689566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689566, "uuid": "58b7d142-e6c4-4918-922e-6ad86e9b3fb6", "comment": "Malware payload (Mirai)", "value": "f4be5d0ea198993c10a0ebad865e80a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689566, "uuid": "628ab006-30b6-4558-bfa5-0613a7b670e6", "comment": "Malware payload (Mirai)", "value": "8bec27cf846326b147531cb7adde85dee8d692078e00381d42229205ec110559", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689566, "uuid": "f22fb05f-6a82-4918-81e3-7c831be80a95", "comment": "Malware payload (Mirai)", "value": "6e4becee3a6c92fe6955112ff3802910b203c372", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689566, "uuid": "5ab83aad-13b2-432f-b9ec-ae98e30035a4", "comment": "Malware payload (Mirai)", "value": "a37762dd6c938e3f6977f55e61f5b5b666f41e8a1ee5334f00d172c5ab872daa36a62430c0015f045b735f539065be8b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689566, "uuid": "a7da5483-a19b-4567-a33a-cea32fc64726", "value": "T118146C85F683E1F5DC150835502BEB361E72997A613BDE42E3ACCA76EC02B41D11B6EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689566, "uuid": "a449ce8f-3686-4a26-ab74-9a8d03023267", "value": "3072:RmTYRFBBt0DbWiswJ7zTFlFyT65GsKxfr+D584aDG8y6:kYDBBt0HxJ5+65VXaDG8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764689566, "uuid": "19a110da-f0e8-4f6b-860c-1f1827506d97", "value": 204776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764689566, "uuid": "11ab18ff-8966-4ef1-b5a2-552e233578ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689566, "uuid": "ef0f9c7d-9d27-47b4-ad56-c0edd503a6db", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1820a3c4-cfd2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764716170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764716170, "uuid": "208627d8-68cd-4763-a4cd-89fe44dfaefb", "comment": "Malware payload", "value": "b5e711ce6c5b1fff310bef8504c3731a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764716170, "uuid": "418dccf2-9b60-4c25-b677-4964d3dc6452", "comment": "Malware payload", "value": "8cb0e59c0c8958abcf12f303f16e33727f88ba043e039e06a0fd1bccda5593de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764716170, "uuid": "69bbc239-4baa-45b8-b487-e18a36f9f986", "comment": "Malware payload", "value": "629479e18e845caea7fd0205706f98d57a712692", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764716170, "uuid": "ecd47ef8-2a4c-4a69-829a-dea887c161cc", "comment": "Malware payload", "value": "06a021416cfe8922574c96ba2d85ee3937334c5b31c682b825ad7772c4fd99526827f5f426e04b39ec6556b662b38f26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764716170, "uuid": "dbfd3f44-2b8b-4936-a232-2697c8ada8f9", "value": "T15A96335BB6AC07EEF9A69238B5708471D25ABF171B11C593B2E4DC6E0D231CC1A363D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764716170, "uuid": "606ee2cf-cc4f-4de0-9e69-7e0cd2409a12", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764716170, "uuid": "5b562b6e-a6de-4a53-b7ee-7ae6dd55933f", "value": "196608:TCugl7Cp/urHmoFP/XRL24GG2/Tsj+lOnO:TCut/uCAXs4GP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764716170, "uuid": "a161b4ee-0667-4f84-befe-aa5b1c7ef9a7", "value": 8772804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764716170, "uuid": "4713a6a6-778c-40e3-a40c-757ae8de0edf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764716170, "uuid": "91af4326-0c8b-4fd5-8369-e0791b4d6204", "value": "eu_2344.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80c81e0e-cf90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764687999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764687999, "uuid": "4a6aa4fa-d28b-4dee-92c5-3130d2122829", "comment": "Malware payload (Mirai)", "value": "73c937303aeb6b005161c25c9698cab6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764687999, "uuid": "3148ffcf-bad1-49d6-89bb-50885739b04e", "comment": "Malware payload (Mirai)", "value": "8eeac085e446e6aa3545a76ca7066a0dde341aa09626075a7323d973dd10b231", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764687999, "uuid": "cbb86b49-f212-4f54-9264-9d02ec4901f8", "comment": "Malware payload (Mirai)", "value": "373e969af4815926d10b7d228aa6fb18c6d3fdfd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764687999, "uuid": "ee4047c9-0d68-431c-8344-911e68feb09e", "comment": "Malware payload (Mirai)", "value": "89d0ad66665fb274680a4a9bc6e6c295d17d21e52cba56704a84a3d074d58436f72c1e1ee7b0ebd8db95900879eb216a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764687999, "uuid": "2dd5c25a-981a-4456-93c3-061169100718", "value": "T13D23F1211F847870CB3094B2B9DF4F926E6247E441EAB853135A6BE029DC45A3AF2743", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764687999, "uuid": "aac3417c-9da3-4cd4-9426-cd0a56478e61", "value": "768:Tgc/MV+wUyFzYfbuRn117BTXW3AGN807+OdTppGd5S9q3UEL1BZ3LPB7gwPa7CgZ:TlM3EfaR1Jt+AmQOxTI5HL1BdLBVPa7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764687999, "uuid": "7119d9f9-73b2-450d-9cd1-dfde37ab62ac", "value": 47796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764687999, "uuid": "a291a103-e0b4-4bb3-834f-9f18d1f9e31c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764687999, "uuid": "2c777a6c-bf5f-4743-9a02-bf0c71b164c6", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03660363-cf94-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764689506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689506, "uuid": "c7c9a34f-e2b3-41d8-b400-6ff63b49d209", "comment": "Malware payload (Mirai)", "value": "92c9dcbf9069f285d6b2a42ac5dbb2ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689506, "uuid": "0f2a9822-21ac-44fc-9fb9-41a8fbb6a0e2", "comment": "Malware payload (Mirai)", "value": "8ef96f4d02feb5d517c2d2ba30e1056cec54a310850058af5ec5dcd9ae484932", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689506, "uuid": "79f85f1e-3d0e-4490-9cce-f3951b65bb51", "comment": "Malware payload (Mirai)", "value": "c883f7343d152d937691bbde199bc619142446c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689506, "uuid": "47f92838-acf5-4c38-b76c-c699d75083fa", "comment": "Malware payload (Mirai)", "value": "5bf4538d33a3c376025db36301c1639400878420a07c43ee09c7d6b2e03dea6a37fe0ea4a5b90702cf62f03c7f43572a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689506, "uuid": "f0b5e00d-f81b-4471-bbb6-e7ec7180d7d3", "value": "T106930246C4C1405FDFBA8536D49E12870C8685A0FB8FCB9D25AA86C0D708BFB759D5EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689506, "uuid": "7055d7f0-c4dc-4d6c-adab-b6a005254a30", "value": "1536:XNu+xe/Sgk2AwYlPL6updTIZxq3+sKrn5haqu27fK5aMgh/9z/GyJcmv:X43Sgk2AwYlPWY1IZxAE5haqj+zgZVGy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764689506, "uuid": "15805823-4a63-421e-9d5a-5c9bd644d728", "value": 88820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764689506, "uuid": "7c348e01-8ce3-4c2f-90d2-eba67876c499", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689506, "uuid": "6741a267-c448-4bfd-9433-f2879022462f", "value": "ecco.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "334d6fed-cf3a-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764650932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764650932, "uuid": "e64b44dc-989b-47fb-87cc-f4f057cb90ee", "comment": "Malware payload (Gafgyt)", "value": "f32e085c1f729841641fb6b0fe73fc48", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764650932, "uuid": "73d4d1b2-ca06-433a-8e79-cd22b00ebceb", "comment": "Malware payload (Gafgyt)", "value": "907b8f2889becce57d44c9fbbda7bc1aa9f30058732db0414d1cc2e6ca623d9d", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764650932, "uuid": "58cf3ad2-dc3d-4b78-b8fc-b25d4268a99f", "comment": "Malware payload (Gafgyt)", "value": "17d9a92918a64b4da34126a8c18adb0c55e46ebe", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764650932, "uuid": "6722f42b-89c0-41fd-8b34-36b2c86a4006", "comment": "Malware payload (Gafgyt)", "value": "1e75f23b5e05436abacff96f49b92f8c8adef49cb44ea62c3b8cebd95b1f03b464e077ff12882003bdd8c2f02eec16f3", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764650932, "uuid": "bb996d1e-e5bf-496a-9acb-91d0f67da304", "value": "T15C318BCB21D21C747D61D9A332ABC804B6E9A08619D95F8C7CED3CFA808DE447D44B93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764650932, "uuid": "0dc0a54d-c853-4f47-aeae-ba165b61bd4b", "value": "48:vY1EYArYC+MYgrY2YlUYOYOY1UYCY/CYCYJ:vY1EYGY5MYgrY2YSYOYOYGYCY6YCYJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764650932, "uuid": "38a6d317-7130-4b42-b43e-c05da655a97d", "value": 1613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764650932, "uuid": "7e9a6f97-9290-4e0e-8e41-2387126864fb", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764650932, "uuid": "0ba17723-d5b4-4e12-a437-143a2135c524", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86b45e75-cfb8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764705188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764705188, "uuid": "2de65401-2118-4ff8-b8b9-a9b90b748484", "comment": "Malware payload", "value": "a68d56f97bb0635ae504792533f1213d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764705188, "uuid": "6a0dac2f-aa40-4121-8d1b-73b7a03cd060", "comment": "Malware payload", "value": "90ec9d4b906a15509643bb14a74dbc0200dd9b95329676d0f5ea94657fc1de26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764705188, "uuid": "7d0a71fd-247a-401b-9411-e76f221384a4", "comment": "Malware payload", "value": "ed245324cfeffeadc26697855b404431b73a050c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764705188, "uuid": "fda65784-9ef3-4dab-ad5b-7785a91956b1", "comment": "Malware payload", "value": "0f7a76cae2967a86af219504f79b4c6f634da20f9fccd325212db0105c0e5c88fbb447af6a17f8ab232fc5d5426c700e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764705188, "uuid": "f464b0c7-0c1f-4fca-af6b-562fd74e79e2", "value": "T106466C73B950C5A9C19BF238E8959A853171BC98873633D70F123D720E7B7E41A3A35A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764705188, "uuid": "5221c040-26e9-42ba-9ac5-2cbeea793c5d", "value": "da7f8acb6151c95be088a02465d68ef8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764705188, "uuid": "11fd7628-b453-400b-bdb8-2c18f0dfdd50", "value": "49152:ZBRDGRVRhQXThlyu3VqLMWmF/I4LHbuxD1ApeDgCCa3HMvEj1xzQg+56f332zoU:ouWwXpecCCa3mEj1xuU3MoU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764705188, "uuid": "c8262d8b-c21a-4e78-868d-60c6041e3802", "value": 5870880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764705188, "uuid": "2da8f45a-3e76-42f8-8b3d-222b3c6cd843", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764705188, "uuid": "b4921bb0-7eda-4489-bc31-5f2dd725527e", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f2dd2e6-cf5b-11f0-a129-42010a9c0007", "comment": "Malware payload (a310Logger)", "timestamp": 1764665286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665286, "uuid": "4a304e33-6ab5-4b82-9272-9e34a37d3962", "comment": "Malware payload (a310Logger)", "value": "10bf43a181b5258c242b5adfd10bec7c", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665286, "uuid": "90192f11-6d4a-4dc5-a16c-5281b82da27f", "comment": "Malware payload (a310Logger)", "value": "91adba40b3c7691251047fb81b35d0efad25c3d1e2947db6f7d151eba1f34a21", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665286, "uuid": "8bfff492-2eb8-4781-be8c-f7b768fd6c9a", "comment": "Malware payload (a310Logger)", "value": "de52db7251f2d7cb945be9984a95a48aa5357d49", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665286, "uuid": "2bbde02b-149a-4eec-918e-09bb43ee4793", "comment": "Malware payload (a310Logger)", "value": "935d8e2f0b8439a3ec4f77d1a1849db1d22c66efdea378bdf61169f035e3d1319f92e1a98e71dcf7cf29ad1974667b5e", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665286, "uuid": "b6383b09-d9fc-4d34-8e66-020ba9bb26d5", "value": "T1E385E15162E18972E0638BB45C17A3DE5829BFA03E7468453BFC3F9C9F366613C152B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665286, "uuid": "536bb90e-3a61-4ac7-b45e-7efbed416f12", "value": "cbdf52e1de4d41eb3f6bca9fb433fec6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665286, "uuid": "32b34e3a-ff0c-46f2-9e50-ecac2ddba115", "value": "49152:CwD2dMOimPPqyJWCC8fAIvJLOQsMMcxlirTO:CwSPPrJ7IIB3PrirT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764665286, "uuid": "0890a3d0-e541-48ca-90c3-69f04bf0f05f", "value": 1716736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764665286, "uuid": "c2371d2c-c202-407f-99a8-3960e25b84ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665286, "uuid": "848c9ee0-877f-4e8c-933c-466083fd49d0", "value": "Vessel Particulars.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7193f9b2-cf3c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764651895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764651895, "uuid": "e6a85325-d949-43e0-b8d8-d0ac35bc6500", "comment": "Malware payload (Mirai)", "value": "52a8d4589e380539288c2583358627a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764651895, "uuid": "6355673e-dea9-4a9d-b67f-95189b4e32c1", "comment": "Malware payload (Mirai)", "value": "92013ba19ddc4aecc1524cf48709d4c025b61fd24f83eaa0944bf2b8533959df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764651895, "uuid": "006317c2-73f7-4703-a559-c62cab9904c6", "comment": "Malware payload (Mirai)", "value": "87f498dd1813386918aaa3b5097623b283c88752", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764651895, "uuid": "60041668-939a-41ae-a35d-945f2c0fe633", "comment": "Malware payload (Mirai)", "value": "b69bacd05ab597957f52cb2fb8696e4cb4d75fc6026a28e04a92631c0dfee5c8c7933aafa189e74cbae95fdc42a08893", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764651895, "uuid": "b3f51448-6cbd-4db3-8394-344c1c603bc9", "value": "T111256C56F1A370FCC56BC031439FDB63A836F46A00216E7721D4A9393D52EA12729F6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764651895, "uuid": "5567ceab-4360-4e42-a416-f002d211ce59", "value": "12288:EWR8AaFtnbubjRRM9goxUwdTBU7bEkJ2yyjUjQLl:LaHnibjRRM9goxNTW7bJyh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764651895, "uuid": "6d18f85b-d084-42d2-b3d0-35b4931fc292", "value": 980016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764651895, "uuid": "f5752b9b-2e17-4eb3-98a7-8192e298d242", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764651895, "uuid": "6d2863b4-b848-4d9c-93be-42e6428fdc3b", "value": "sync.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ce449ed-cf47-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1764656693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764656693, "uuid": "db6dd52c-ee09-4e86-bbc5-5e99b1435c64", "comment": "Malware payload (QuasarRAT)", "value": "1a0c632f7e9409efbca74245f8e99283", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764656693, "uuid": "5cbf4e67-baab-46e9-a337-5e004ce9abd5", "comment": "Malware payload (QuasarRAT)", "value": "92478c525daf58642a221dfda3782d6414d2040976fea242effffbdc854e813c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764656693, "uuid": "38e27795-24c0-4d4a-b86c-03cca1b24f26", "comment": "Malware payload (QuasarRAT)", "value": "78554277391c28163255b456dd9bf40b39f9b31d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764656693, "uuid": "a4d6c50f-e6ae-4a7d-a7c0-d54f7c7af782", "comment": "Malware payload (QuasarRAT)", "value": "203489319bc60fac9f47244c5476564b0dd8f0617e6e76de51b3db25969c08271e2c9fcb1b0d393e2b3527712b5e289e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764656693, "uuid": "e6a8a692-5c7b-4a06-a44c-5183556d9450", "value": "T1A2748C1333A4E93BD1BE277AE03206154BB9D507B616E38F9A6855B82C533C68D913B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764656693, "uuid": "7b770320-4ab9-4363-a78a-0165929821e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764656693, "uuid": "598e00d7-8f02-4f35-82df-652b5f85f630", "value": "6144:++NHXf500Mr5d2HIIIIIw9dVcXbRa/g2BxZKkZnwn6m8g2:1d50oG0jBxZKkZwn6m8g2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764656693, "uuid": "a59eeaa7-5b06-4242-ba88-b09fb8152b02", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764656693, "uuid": "eed9183a-38f6-44cb-9d9f-2b367273c760", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764656693, "uuid": "1393784b-e94e-4cc9-bebe-2de9aca4ab1e", "value": "Client-built.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94e3f3d5-cf2f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764646371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646371, "uuid": "0b597824-d222-48c0-9a70-2c908a55aef7", "comment": "Malware payload (Mirai)", "value": "67befc425eca13800222cd11e07e96c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646371, "uuid": "b4a29012-c309-4a9b-82b3-c03dd1181384", "comment": "Malware payload (Mirai)", "value": "939eefddda4e2f90d0bcf39a8aaa22274acd04e05359b80495a73c431bd0bceb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646371, "uuid": "7bcca320-81d6-4a1c-a700-325a9d4ee8c5", "comment": "Malware payload (Mirai)", "value": "db404ea2c65a127583f2cfcbd182bb8b9758790b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646371, "uuid": "5e2d03f6-810d-47b9-89ba-6d274a70fae5", "comment": "Malware payload (Mirai)", "value": "7eb36f0c9ece90669de185d226a92cb4b8fe13bb76781c8ea3a5ab8f539256d8ac214bda84bfe0844dc77d62b211166e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646371, "uuid": "45999bda-f461-4a0a-b86b-59c8aec65c51", "value": "T135530985B8819A25C6C557BBFE1F018D33069758E2DE73128D145F647BCBD2F0E2BA0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646371, "uuid": "0a5fc546-f0b2-4c13-be29-5c1b6679c9b4", "value": "1536:4dnPA1/8MPLnGobc/sQTAM9i6jLMICiFqskQF:rN8ybGicUQTXEMqskQF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764646371, "uuid": "35d36146-3e17-4126-bb27-54376879fabf", "value": 66688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764646371, "uuid": "8452d493-38a6-45c7-a154-edf10192a043", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646371, "uuid": "d0d6cb46-ca89-45a3-9243-52bf71a3fa9a", "value": "3atoNational.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06d055f5-cf4e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764659447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764659447, "uuid": "865b4be4-e620-4847-8dfb-f531ca4ee9e9", "comment": "Malware payload", "value": "e5b462ed658fee8ec3f114614af2b5d2", "object_relation": "md5", "Tag": [ { "name": "95-164-123-38", "colour": "#E1E094", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764659447, "uuid": "fc1cb3a0-8295-4773-b142-2111da0d5908", "comment": "Malware payload", "value": "93a65c1c1694060b496edecee377a64f1346aec189c1a01a3296e13fb57954d2", "object_relation": "sha256", "Tag": [ { "name": "95-164-123-38", "colour": "#E1E094", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764659447, "uuid": "a6ed8def-d088-47a0-b9e8-1e353eab7ff3", "comment": "Malware payload", "value": "e0dde5ede557b9cfdf6e7b758a22406352881227", "object_relation": "sha1", "Tag": [ { "name": "95-164-123-38", "colour": "#E1E094", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764659447, "uuid": "7a9eb4e9-b8bc-4007-bd23-2880df1cb7b5", "comment": "Malware payload", "value": "fd23124531f89637645796e1305773e981d8d4ff8f08feef3009bc037fb6b038eb87d572b6e7e5ae5a228898d3d1abe1", "object_relation": "sha3-384", "Tag": [ { "name": "95-164-123-38", "colour": "#E1E094", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764659447, "uuid": "c8042547-2cd7-4ea8-9c56-a7469824ca68", "value": "T1BC62C7F950FB65348573326E8B1FA415A626F0133549EDA1BA8CC3509F42628D7B3BCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764659447, "uuid": "2b744d37-8cf0-428a-a351-bf3fb4e32e36", "value": "384:nK6ldyHnXx194cq0mLtbjUh4/+jKJjZOxe:nKoAb9blmZ1mE1Oxe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764659447, "uuid": "c046ee52-6acc-486e-b195-bce80a434051", "value": 14592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764659447, "uuid": "24b114b0-f45b-4fb9-8c7d-0c4d6619502a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764659447, "uuid": "023fad1f-eb94-4dce-b86c-b587080a6ae7", "value": "93a65c1c1694060b496edecee377a64f1346aec189c1a01a3296e13fb57954d2.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7934720e-cf90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764687986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764687986, "uuid": "0273448c-f708-46b3-8481-c04690260014", "comment": "Malware payload (Mirai)", "value": "4a21fd6ff1367b0b88186a53cbb1fc11", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764687986, "uuid": "16b36024-b4f4-4e8b-8c99-d7b3f1cdda59", "comment": "Malware payload (Mirai)", "value": "93fb5c2e8cab764edb729a464c06fe3161081a9ddf820bbc53b668281f2a3701", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764687986, "uuid": "d56264ac-68d4-4933-b139-6ff1e03c81ce", "comment": "Malware payload (Mirai)", "value": "bd67a949eca3d38941740463c47dbe28442fd5d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764687986, "uuid": "173efc0c-2ee8-470f-9ec0-eb20331b86c9", "comment": "Malware payload (Mirai)", "value": "a717b12360490b76c45df542bac05f5ba013d397a1481258b72e87abb4d998a5b3b15d9eca46663db41deec9d088d7b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764687986, "uuid": "2765e77d-f512-4e61-96a1-7cb214c9dedd", "value": "T14C632E39F5261B23C0D3547921EEAF067DB057C933D4E54A3AB10BBABEA25437841DE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764687986, "uuid": "baff1bed-3b96-49a7-b955-a5f4f7c1ace6", "value": "1536:jve25s23zFLR6B48P1Em4ZuMA3b91cQ1mO4hqXWO:bqQwV3bfD1n4gXWO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764687986, "uuid": "b4bb36cc-9291-4d6a-9da8-de1f1c5b39ae", "value": 69520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764687986, "uuid": "4c0044be-992a-4e66-84ba-2488ad28c0c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764687986, "uuid": "d1828de3-e2d3-4441-9d78-db59c936c76d", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3243d88a-cf8c-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1764686149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764686149, "uuid": "bde430d9-8465-433e-9c42-feb555c16d1a", "comment": "Malware payload (Vidar)", "value": "e0414ae66b8ed242a8a3c26e7af14527", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764686149, "uuid": "2de6ab34-99de-4c12-bd08-b9ae3b8c44fa", "comment": "Malware payload (Vidar)", "value": "943574eb8ea3dc8a2ef56db331a6b828d529e858465a0cc79f9426bb016cc517", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764686149, "uuid": "7ee46c2c-7189-4590-b572-099576627a8a", "comment": "Malware payload (Vidar)", "value": "d197f5b352ac50cb0f1f77523b717efc8400dba6", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764686149, "uuid": "0e8ae201-800d-4b4d-a301-2f68f9160771", "comment": "Malware payload (Vidar)", "value": "1437d2ff642084dd69b1547c6143af88aa77cf7ae43feb189657c6d45c0afa48cfb390a62f48b531c6081df968d47c8d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764686149, "uuid": "514914ef-789f-460f-80d6-bd2914e5792f", "value": "T1B5361916AB6586BBC09AD335A9D27585F270FC140BF027DB168476722DFB6C80D3EB18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764686149, "uuid": "e20b127c-5499-401c-b04c-858ac5532fa4", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764686149, "uuid": "09953b21-f6ae-454a-96de-576950df1e9a", "value": "98304:OP/FhlXcc6Z0E3taLiSQei+MKPv3lSwC8p:OnFhhE3tKjnnlC8p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764686149, "uuid": "7c3a5ec5-1f8f-4a07-a6a6-14c6a289a30f", "value": 5056152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764686149, "uuid": "b33355ef-b4fb-46a2-bd5c-9bf6f30c683b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764686149, "uuid": "74f41461-3669-44fa-992b-a9a52c300f8a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13277bf4-cf5b-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1764665051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665051, "uuid": "45b85234-b709-4c93-af08-af5defaa4af7", "comment": "Malware payload (Formbook)", "value": "e4f49201a6685f0811baf697dbe0ac80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665051, "uuid": "e5cbcaea-a605-4822-831e-615e85662092", "comment": "Malware payload (Formbook)", "value": "949a1a94161e7ef47d64f71f7ed3ee0cf7db1622ecfad7b81f7ffa6f9f42e264", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665051, "uuid": "5221b417-51c4-40a4-b494-df8d39d1c197", "comment": "Malware payload (Formbook)", "value": "ce9cbd237cf338f35392db9dc8808572f1c1c0a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665051, "uuid": "90a25a32-3f93-4bcd-93c2-6f7378b3ece5", "comment": "Malware payload (Formbook)", "value": "045dadb446f5f9e262978877217ee0144ca6b354aeac6251150cbee47c15fa08c91b38820e44ab23d51b1261ff2fd633", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665051, "uuid": "1045dadd-70b3-4d6b-91e0-4f5af6f07f60", "value": "T163E4129526A8CA07D9622FB12C70D1706778AEEAEC60D20FEFD93EDFF079A445114712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665051, "uuid": "ba1c301e-fc94-4545-8169-087a2c704cfd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665051, "uuid": "e90dfdef-a268-4180-8be3-a18156e8957f", "value": "12288:FdnT5FhiQr9Xng6rKLA18oaw59FS6nKhcWVmAr/43d8v471j:F97hiu9Q6rKLfoHY6KRgfey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764665051, "uuid": "b16df47b-c78c-4eec-a093-9317691710eb", "value": 670720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764665051, "uuid": "85c4ad1f-33ba-4a7e-998c-f468ee801d30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665051, "uuid": "acf376b3-a8ae-49bd-a4db-c997cb41e4a2", "value": "REQUEST QUOTATIONS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71fc7c13-cf60-11f0-a129-42010a9c0007", "comment": "Malware payload (Gamaredon)", "timestamp": 1764667358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764667358, "uuid": "a4e6b7d3-f893-43c0-83d7-deafacf15d55", "comment": "Malware payload (Gamaredon)", "value": "03e5e93d7ba5fd5977eaa10fb52cb44f", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764667358, "uuid": "beac7426-49d7-4c04-8f00-38e666e451b0", "comment": "Malware payload (Gamaredon)", "value": "95262c4094a9a5e589a218e354ef54b3800aa0abc3b6a343bbcfdcbf021fc04f", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764667358, "uuid": "9ab7712a-ab7e-433f-ac42-04b6e2cd5571", "comment": "Malware payload (Gamaredon)", "value": "f34835e499406cc402f1ddd054ef372386ad5137", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764667358, "uuid": "73c0d442-5298-452a-aa91-28c5098f7c23", "comment": "Malware payload (Gamaredon)", "value": "7c3b7b1196be693c8410d862c9c6c57d7dcac6b2f093ec97fadcb79f059c026e3c49c8882c2ef4cf28148ece66433277", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764667358, "uuid": "366e704e-7fe6-4573-a225-80164d681a26", "value": "T1D7310B82B57D8086D7047732E94ECB47F037EE55157D49523054A84F159850B82331CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764667358, "uuid": "7126c706-adf4-4c61-92fc-5e3a9da9d7e4", "value": "48:ZSAB/OtGTtLgoCuGNCBYGLf41aN2RJ3ytjLztFmZpQy:ZSghTtLhGcRN2RGDupd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764667358, "uuid": "b65c5a24-49fd-400d-b17a-79d1ac766436", "value": 1856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764667358, "uuid": "8c0997df-9ae4-4a21-8331-530562235ae9", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764667358, "uuid": "df5c53e5-4e06-49b1-aed3-1fdaa4d876f8", "value": "2_1_1_7755_12.11.2025.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f883ed3-cf7d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764679782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764679782, "uuid": "4dc470b6-1f1e-4f4c-80cd-96a3897d384a", "comment": "Malware payload (Mirai)", "value": "341e92dd2e4ee02cece477a7147a2553", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764679782, "uuid": "2aea9148-d782-4ee7-9890-3cbd7ad054e7", "comment": "Malware payload (Mirai)", "value": "9527e8e5ef942439684894c7dac90c7fc0630b726e8a3e97fe068991ff237f4b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764679782, "uuid": "ab6d332a-6157-4e87-a75a-29a889aa9241", "comment": "Malware payload (Mirai)", "value": "da29969cee9f5d83d9e97ce0267472444b44ba41", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764679782, "uuid": "0bc3ebea-6173-4f9d-bd8d-f61359bb7fe8", "comment": "Malware payload (Mirai)", "value": "600e21881310e74d91a24f86954033fceb4164e5b88f3d0da5124dae5ae19011ca05d89c263199c2a48467df9f17ee4f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764679782, "uuid": "9e80acf4-b1bb-4550-bc37-e76975952032", "value": "T13BF3BF72D432AD98C1094274B8E4EF795773A04045AB6DF375E6CB69508BFEAF0287B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764679782, "uuid": "57ac9168-e8d7-4e81-af1c-ae01384e7013", "value": "3072:yWJsAKcbGoilJBeGmdWpja3fs8tf/st49f:yW2cGoi/pRpGfZst49f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764679782, "uuid": "f06143e0-e388-4119-ab7b-f1dfd3a45946", "value": 157524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764679782, "uuid": "2172dd07-cb84-4bd1-ab29-9478525ea496", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764679782, "uuid": "3a3447f3-057e-4c6d-adad-518e25132b0b", "value": "morte.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d26813e-cf2f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764646251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646251, "uuid": "0153ee46-7f92-4821-82a3-5b0d07f2ec6f", "comment": "Malware payload (Mirai)", "value": "449da3051aca2cc1e837707b082c013c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646251, "uuid": "f03d9ca3-bf2b-4bed-bb9c-379a207fad08", "comment": "Malware payload (Mirai)", "value": "95327c278d36e61ed6667e59d8cf2b5e7934fda5321f3f7fc5dfa2175439e7ba", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646251, "uuid": "06831f76-242e-4e79-8f97-43c496fd5fce", "comment": "Malware payload (Mirai)", "value": "bc4e3ec81596486ca6ed25e97aae8270c7b4b6fb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646251, "uuid": "2fb16508-7908-4bca-9ca5-7020f3f6fdb1", "comment": "Malware payload (Mirai)", "value": "a13c7017023c13a07bfe3197865fbaf4f95da25cc641e6569e1a696765a67e87577f29798237c6018787b6102a7fff70", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646251, "uuid": "39b36adb-30f4-4ebe-846c-d1c098d8ee9e", "value": "T1AD3185E4020645BD2C919A57BAA8960472A3B5AFADE1BE48F4D838BC724CF5C3052E47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646251, "uuid": "65330d36-a53f-4ab0-bcbb-795e0460afee", "value": "12:q0FtO3L4a0FtZ3I20FtNi3uu0Ftzex3zed75a0FtXL3Tp0Ftbi3ia0Ftl3+3+0Fo:v+6cjfVrh8675fcxd+xFbil/kk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764646251, "uuid": "e8e6afca-0e3c-4f0b-b0f9-da8abd8e52ed", "value": 1783, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764646251, "uuid": "e92a2d86-8b7a-4e2d-9795-a26853b710ac", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646251, "uuid": "5b576729-ca90-449b-bfc2-ca6f2f22061a", "value": "jewn.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b66643ff-cf6d-11f0-a129-42010a9c0007", "comment": "Malware payload (VShell)", "timestamp": 1764673056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764673056, "uuid": "a3776bb5-089f-4a3c-bd3c-b67187e921f2", "comment": "Malware payload (VShell)", "value": "558af239b8574e8938b1ef6c3fc4c26a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764673056, "uuid": "a1e9265f-14d6-4eac-825f-015f5b2d3345", "comment": "Malware payload (VShell)", "value": "95682e021447f2a283e03d8d049f3f22e1f83da30dc55c5194f9c655c806decd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764673056, "uuid": "6d99b6b4-6c48-4bad-aa4f-52a6b4c31577", "comment": "Malware payload (VShell)", "value": "2f144c79ded7ca9e2637f5ed08dcc21faa74944f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764673056, "uuid": "cc82d961-0765-4241-ad6a-49d66c861ed4", "comment": "Malware payload (VShell)", "value": "f65de47b41dcce4452c4be4d81beffe7bd05028d17df94eebb6eda0e7c1d5222bc59c494829ae69cfdc9e64756cbd8a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764673056, "uuid": "7853dd59-a15a-4310-8e48-66f01c9bce8c", "value": "T177862847F89041E8C0EED174CA669263BA707C895B3063D72B50F7B82F72BD46A7A354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764673056, "uuid": "2e557413-5687-4a14-b035-5d78b2117bbe", "value": "49152:sRm6tkO15VlRArb/TivO90d7HjmAFd4A64nsfJIyMVmbfugZjs38LVBiz6LbtPX/:glRJXp8L/KyZcCb78Eew+k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764673056, "uuid": "d9f67ba0-25e8-4d9f-94df-47b418488c04", "value": 7864320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764673056, "uuid": "952cd788-75a4-445d-9baa-0c5cf7962e6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764673056, "uuid": "74196386-86d4-46cf-be98-9ead3c75cf70", "value": "memfd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c8a622e-cf94-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764689522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689522, "uuid": "8f5fb4c8-da3d-4dae-acc2-c9479b87ac87", "comment": "Malware payload (Mirai)", "value": "60c898ecf7434e42f5b0e7aeac093133", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689522, "uuid": "1d4f72ed-7a14-4d9a-bc44-5fdc6b441ae0", "comment": "Malware payload (Mirai)", "value": "95781432349bac13684f77b948f9e17e05a5e068107836481cedb8ed80d23b20", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689522, "uuid": "f74daee6-37bc-4aa3-8507-d25371ce9aab", "comment": "Malware payload (Mirai)", "value": "ab0fc893e4071c16abbc64d8f598e97ca9200bb7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689522, "uuid": "7b57bde5-d477-4551-9d6f-5959346e91d3", "comment": "Malware payload (Mirai)", "value": "1cddd9081125d70dc42001a38adc611c51a62cf36df4486120a095a494c6937bde3e53747b94d192fe5aa189a3300f7d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689522, "uuid": "2f04a653-160c-461b-9240-52dc65bdd476", "value": "T15034B0A7F78E14E1C85601F40BCBDF5E2B1315061DBEC2E678693E3A1D6A1CB25217E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689522, "uuid": "30388baf-2c49-441b-b489-eecd8fd4aaae", "value": "3072:KUDcleUDwIk4fOxexpMNZlJAHx1OZLsea0RUKJnoqfASngSCzkjXucakDq:N8JNfOxqMYcs+Rz9bDDCzkjXOkDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764689522, "uuid": "06628a76-4767-4e3b-9718-2448410ca259", "value": 231224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764689522, "uuid": "66c4b8db-4ffb-4d13-a934-f37813419095", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689522, "uuid": "3ae991d1-14f7-4e3f-beee-ad2a91a27e35", "value": "ecco.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a511b08b-cf58-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764664008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764664008, "uuid": "d0d9e457-f4e9-40fa-abdf-6a79df0b8509", "comment": "Malware payload", "value": "9292867bc3bab1cb5e1ea64b68f4b08f", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764664008, "uuid": "e27a7529-7fc5-47e6-9104-a7fdabe665af", "comment": "Malware payload", "value": "957da2245cf32478e9b9b9910bc16e3875e4d32fc7d16a4d745ef96b7a021914", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764664008, "uuid": "b801f1fa-9ec0-4c01-a722-6f5823172c66", "comment": "Malware payload", "value": "648c9182fadff334acafaf2969fa7fb6c3727c5b", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764664008, "uuid": "c679db12-1a8f-4307-99a9-196415479d3f", "comment": "Malware payload", "value": "b1d29e7bfb1ebf17625f581c969acb9fbdd905abdf9dd23caf0033fd6886f39479e7cddfc2479ffed4cf72dbbd5e4ec4", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764664008, "uuid": "2e9f61a6-699b-4e77-9109-4d841bb49a14", "value": "T1931722C5F7C95A2FC4776032C9AA52F2515B5C13CA439F83A968730C28BB5E40F5ABD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764664008, "uuid": "ca46c2b8-258c-4f08-8e57-0056dd3320fc", "value": "393216:buIuuuWuYurjf6KzJqsY7ol8xF62ZKDF9Hsgh4H0lO:SRbjhrjBTY7ol8xF6RhE0lO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764664008, "uuid": "efccc561-aa01-42b9-908c-18010437433d", "value": 18910736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764664008, "uuid": "baf30775-17bd-4cbd-af5c-c14f6f125a78", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764664008, "uuid": "2df94dba-e637-4213-aad9-dd293c1114ed", "value": "pe-app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "094ad1c9-cf3b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764651291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764651291, "uuid": "0ed4b84a-c19e-4a19-9607-637fc130e35f", "comment": "Malware payload (Mirai)", "value": "3c3a95121d2363ff273ae1ca4d666783", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764651291, "uuid": "d91b4603-81d5-4fa2-9c07-a0c352a6bc92", "comment": "Malware payload (Mirai)", "value": "959643eb6c43c89b20c98bbd0979c6cc5c4dae41ff7977990a8875fff744ffc9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764651291, "uuid": "4d66b46c-6e26-43a4-b11f-a0737e18ecfb", "comment": "Malware payload (Mirai)", "value": "705d0ec103659567a9d3d7fcc551784c84b4e863", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764651291, "uuid": "9446ee97-68d1-4edd-ac64-0db49b15c4e0", "comment": "Malware payload (Mirai)", "value": "df809c66a62cb9a54866d9d403fd1a3bf8f63e94cb6c5d483b4748edd8f780c84c0aabdcc9001d0453efa3a03b048fb6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764651291, "uuid": "df6b1311-d77d-44ea-97b9-bc26db674988", "value": "T16301F08981801F735B84ED1F7693842F0226E2C9161727C0FF9D5A78ABC47CFB018972", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764651291, "uuid": "6ab8a424-617c-4c62-b7e8-72d5fb6bbcb1", "value": "12:KhI5W3CtI1/TbNEYrBwBtEYQ1npLOhcEYK26IdliAE/IQqlHWEaoJi5EN3bQA:KOQyS1bbOAB1N1npLOXtmliAiqlfaoJl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764651291, "uuid": "3b10a66a-3528-40d9-9147-8d47903ee2ff", "value": 698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764651291, "uuid": "165aa036-c6e0-43e5-8307-d48792067f0b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764651291, "uuid": "1fb57111-2358-43ac-a6e4-41778238028f", "value": "curl.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "611059eb-cf5c-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1764665612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665612, "uuid": "488c0182-a794-4f71-98ce-d92cc59e9d46", "comment": "Malware payload (AgentTesla)", "value": "be9e942d68a2d7c5bc4ad3dbd1150f22", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665612, "uuid": "9126cb1b-c3d2-40bd-8fed-33ddbe324915", "comment": "Malware payload (AgentTesla)", "value": "95f214d4e4b557548f2077ed9ab2f260471326b442a45824db16ec7c58fe0900", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665612, "uuid": "5eafeb64-8c25-4679-af2f-8d0d5a62cb3d", "comment": "Malware payload (AgentTesla)", "value": "4d6cdcca416dd5f6097c785426f61232228d6464", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665612, "uuid": "2cc56663-7a9e-4fff-8525-368475806ce0", "comment": "Malware payload (AgentTesla)", "value": "df3a59d6cf7c83accfb3ba562121f6d40aea17077163310c5b347117a5b483e1eb414cb577cd4aeefeb4e866970bbafc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665612, "uuid": "66c056e0-474e-47ae-9002-e2c70acc32d2", "value": "T12435DF5A1EE8DD0BD3910AB54CF2EB3956790F68BC5A93438EE23DCF7A34B482C84145", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665612, "uuid": "bddacfdd-3b0f-4ccc-8eab-141ad36c6883", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665612, "uuid": "55a28e25-a7d4-4672-81e4-8f302deb5793", "value": "12288:G2wf1GjTu1XuEBDqRTCAtFKV7P0/OQLTtx/ReFMKM+wxHCaj2b62h7J:G2wfMTu1BBe91zuT02QpxEqJCZtht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764665612, "uuid": "e1738398-9467-43e9-8ab8-7eeb7738056f", "value": 1089536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764665612, "uuid": "50cad67b-86a1-4ed0-b201-346ffb07e221", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665612, "uuid": "f90e1ddc-e751-4222-bf1e-8aff9f5141a8", "value": "Cotizaci\u00a2n.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9988cf92-cf2f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764646379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646379, "uuid": "cdb775f2-8729-4fb1-aac6-aee424a7e7c5", "comment": "Malware payload (Mirai)", "value": "f658300aa371ba2f282ccbe97129982a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646379, "uuid": "922841af-1b73-401f-a496-ac5a08c0585b", "comment": "Malware payload (Mirai)", "value": "966fe7094c23ff99861bc5602a8d135e69586ef1f685053b4a34b9745aa31c62", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646379, "uuid": "493b1419-a918-475c-86f5-1c49d3b82b58", "comment": "Malware payload (Mirai)", "value": "907351c7df46d73573ac6f218a5f0b8e09d66184", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646379, "uuid": "02111dee-45d9-4d05-9af5-713fbec253a3", "comment": "Malware payload (Mirai)", "value": "8b31441d69edc49e7c9708f22725c89d9d02cef5d4ea614b2cdf0507eda3164b56640d519d730ca3d9c9acbeb873188b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646379, "uuid": "f4fd3446-5260-41c6-aea3-5856c5fd2fa9", "value": "T137232AC57583F9F8DC15057C207AE7729EB7F83E603ADDEBD399A5239812601A20329D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646379, "uuid": "c5194443-8faa-474f-8682-b303788568f1", "value": "1536:AsbZYXNkWLJMkN2mBuQv5pkMiHAkFwAEU9:A9XNj9MkN2mBu85cgk6/U9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764646379, "uuid": "d52b4387-2ecc-463c-8038-783777497d0a", "value": 49752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764646379, "uuid": "0660f05f-2b8f-4f5f-812e-1dc6739ad198", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646379, "uuid": "02c74e51-f23a-47cb-b0d5-52161fac9f5d", "value": "3atoNational.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44cfe8f5-cf97-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764690904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764690904, "uuid": "4c429956-34f8-4d1e-9aaa-da1ec62203d2", "comment": "Malware payload (Mirai)", "value": "7e6aadf5446e8772540143c1345d4c4c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764690904, "uuid": "0a050b5e-99aa-4d15-94de-d2c184c0ce3e", "comment": "Malware payload (Mirai)", "value": "97816202b21f30a349af9869b4c352cb0c3848a5c707442baaa247d03b468b82", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764690904, "uuid": "30a4b275-78ca-4d56-b132-2c84ccba2f5e", "comment": "Malware payload (Mirai)", "value": "c67ba0bbf4f15bff4dc60e44ee3929abbde72d6c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764690904, "uuid": "d6694a08-1dbb-4af8-bdf4-dc7badf085f6", "comment": "Malware payload (Mirai)", "value": "c0adf0ab3c099fc12826fa8e5af8e9486d12109630a8d2e624e3091ad58e99ff8a604978b23aae45b94f7b8b026af891", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764690904, "uuid": "f9b8e910-f299-4bda-8ca8-43129e8aa81d", "value": "T141730256EC6EF8CE96AF87755EBCE0994360860768049EC9DF84252B2805F943D3CF42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764690904, "uuid": "78fc33f8-e113-4f8f-858d-edab4f6f37e7", "value": "1536:K9OywDGduzySCzI/Lo03iDgkExUiNln/WleT4mKLRwHABeJrnYsYl18xjcnnouyk:lyktzKStKgKhle03L6gKnYK6outY6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764690904, "uuid": "026f0db3-754b-4406-9c4b-de53e914ef50", "value": 80416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764690904, "uuid": "bac0e29a-ce1c-489c-9f89-f0eff89fc402", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764690904, "uuid": "0fab8cd2-3b6f-476e-863a-4113580b8be6", "value": "ecco.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45cea196-cf50-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764660412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764660412, "uuid": "e5d467b5-bf4b-4485-8ecc-5a6d40bb3e48", "comment": "Malware payload", "value": "67782fd8f15745092bd6ecce80f9b34b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764660412, "uuid": "b435d74b-256f-43d1-8856-6fda5deb471d", "comment": "Malware payload", "value": "982eecd68c7fd017d9127f54abea176aad2156fba01f4a63550d8b9e61f21243", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764660412, "uuid": "e865c340-ea48-4096-bdae-e3b072bfacac", "comment": "Malware payload", "value": "e22b0267b891e2a0f59e53332b681b6e7e0a4ed0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764660412, "uuid": "aa62d13c-9f86-4b20-88f0-9f4403e52c26", "comment": "Malware payload", "value": "aba00a38a2ce743ba860bcba26a1c93c638e55a169689bec2d0722e2544c06eea465eb995f5f0e3b724b9ab631d226b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764660412, "uuid": "79cc82bb-ba24-40a0-8c00-0397311a9475", "value": "T1C0463A07FC9945F8C0EEE2348A729152BA717C495B3027D72B60F7682F72BD0AA79354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764660412, "uuid": "029b3181-49fe-45a8-9859-9375c642074d", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764660412, "uuid": "f70dd016-2abb-4be9-9507-08451c68f6be", "value": "49152:YzbNgu47/YOCYtWBwzUPCijrSHXxvexIf1OgEIceR2jN5E7LW69TXj3TaOz2D:a6d7VFUPUvkpDPEVzDa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764660412, "uuid": "bb6a7af2-49f3-45c0-8e69-d950b3ef8233", "value": 5412352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764660412, "uuid": "0f1e9a70-6c9b-4fd6-be26-b64dc646a1a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764660412, "uuid": "7e3bc883-d0f9-4798-889e-3e4bda8bf0cb", "value": "agent_mutex.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79634b2a-cf35-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764648902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764648902, "uuid": "a2f5a5ba-6a44-47b1-a87d-3724dd10c00f", "comment": "Malware payload (Mirai)", "value": "8eb2abff3cb3cfccff435823c2900eb7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764648902, "uuid": "e51788f3-3070-4918-a805-dfc22224bbc8", "comment": "Malware payload (Mirai)", "value": "98386a87bf3cbbbb23e8b8c24d1ad217540e1d947dffa7acbf0e33fecac78324", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764648902, "uuid": "baf9a362-a4e9-4ced-87bb-330882ca8324", "comment": "Malware payload (Mirai)", "value": "507f05ebc36210d31a84e6b759d6be4d3cf1f0e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764648902, "uuid": "7f21a94e-548d-4ddd-949d-d58dfa3b41bf", "comment": "Malware payload (Mirai)", "value": "ac373cb85c91bb232b01b613ab525390b52a5a7b3d3dfca3d782eff8843d115496f8c766b7b1caecf9f059c290c195af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764648902, "uuid": "95c2b7de-d3c3-409d-8b70-b4042018e10b", "value": "T10533F1C26D876EA452B16172FE242F8A33C6BC6EC6B6F8210C34455D3C4A5961BBA1C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764648902, "uuid": "33ff4325-9dde-4c61-a2e7-490dc7d9d957", "value": "768:1h6h/yQoPlgetCttJV9xwLgq/S3HnBU3nMCCiQ34fdCMWbbKg0mdQI+Br7OYE9qM:Ch/lq+tJ/x0nyU3Mr4fdC//75AOYtLnS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764648902, "uuid": "fdc6d499-cb2c-4b5f-9885-03243fa86217", "value": 51072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764648902, "uuid": "09d2b10b-0c96-49e3-b573-5a85e8e3c3b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764648902, "uuid": "71d5cafc-6d5a-4e51-89f8-eeaf7464b3b1", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e14f4ad1-cf46-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764656378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764656378, "uuid": "a899f765-e6ae-40d0-b967-3fb5514f39c8", "comment": "Malware payload (Mirai)", "value": "d9315dc6802bbb7911ed04cdffa3ee17", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764656378, "uuid": "18f99497-c678-44dc-9d01-67ef39cd00d9", "comment": "Malware payload (Mirai)", "value": "98d18f594cac45a7805d6e1c792115abf3d67a936294698de65b8758a6e3f76f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764656378, "uuid": "59c35190-5811-4348-9840-17a828eeafb6", "comment": "Malware payload (Mirai)", "value": "845db35bf59d6794615318236468b0fdd1977ca8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764656378, "uuid": "033b62e0-be65-4926-958b-d51e31975555", "comment": "Malware payload (Mirai)", "value": "becf74c255511a7aa8fb1ce1f714655486235efce668c703aa393d6a1e31477b7b2a5d114873503d4756f7ab4dcc04b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764656378, "uuid": "4564d6dc-90e3-475d-8d59-d6d19074920b", "value": "T19FD34B46EB808E13C4D5177ABAAF41493322E754D3DB730699185FB43F86BAF0E63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764656378, "uuid": "301a4633-0bee-4564-84a7-5258cc92c540", "value": "3072:ho9lg+zhz3sJu1NHLL8XmiC/glLCZTiHHlOM/9d0Yj:W9lgahz3sE1lcmiC/g1CcHHcM/9mYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764656378, "uuid": "c625608d-b6bc-4e12-82fd-e11a351d3943", "value": 131898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764656378, "uuid": "2685a77f-ab2d-4228-ad1e-d9a68122ef28", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764656378, "uuid": "a9014012-2f03-4da0-bec7-8ac428e43ef0", "value": "jew.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9652d71-cf70-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764674430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764674430, "uuid": "56c82e60-a1ac-4132-9271-d571b48d0713", "comment": "Malware payload (Mirai)", "value": "0d11a91cd9f70f2d80b9c1ee0906ca91", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764674430, "uuid": "dc36925f-5d4d-438a-bf0c-b9e1e3568745", "comment": "Malware payload (Mirai)", "value": "9957bb5eb67901fe77b28925bed32a032e572f7855849cfa3c75dfd7c6dfcd06", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764674430, "uuid": "039f078c-b0e8-4890-9f3c-9ccde80e6c2c", "comment": "Malware payload (Mirai)", "value": "8d3bea216d09ae344e52727c467e11ec87ce268e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764674430, "uuid": "b6ff7b56-fcf3-4ba2-8d25-62979047c351", "comment": "Malware payload (Mirai)", "value": "9656b80c30a3d38183ce30a6109b58ecc3192db0f2a283bc8e0f9fa72e46e8d842e857c3e623dbf939bb5d1adc16ab8a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764674430, "uuid": "35978081-42e5-454b-847a-bfe0600b2bfd", "value": "T14153028CF42E5452D72ADBDFCBAD76803B359F977394580840896F0622562372B39EF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764674430, "uuid": "408a5d26-4085-4c92-bf1c-9e1934f5b332", "value": "1536:S0aRUpHVGd/lKnYWKbJ+FJWKPrOs/hrOGMQM0Euo02yd6w4u+qgw09G:GMVGxlwyJ+3WTerOGMQMSoJ0F4u+qgwv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764674430, "uuid": "adaec398-8759-435e-be38-eda021705546", "value": 62520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764674430, "uuid": "8d8a69be-8328-4c18-82ca-90e44310f6cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764674430, "uuid": "a0c21908-897f-477d-a6e0-d60d475fdcf0", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23315081-cf94-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764689560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689560, "uuid": "f6877efb-9d10-45d3-a7fd-1212f82bd053", "comment": "Malware payload (Mirai)", "value": "2cd91a681ee16e3857cc17e99b33a24a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689560, "uuid": "0da264e7-3933-4779-aa53-21b487ef33e4", "comment": "Malware payload (Mirai)", "value": "99cfc86014a1ebf75f80aa2e8786883048f360a9051ad5d50b9e5e9b8881a555", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689560, "uuid": "72ff23e2-1017-4810-b46c-f20fafc9d0c5", "comment": "Malware payload (Mirai)", "value": "edd2b880b2a8d6464a72d5f240bbed347f83dd9e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689560, "uuid": "97d628e7-afa5-4258-882c-abd316c3ef42", "comment": "Malware payload (Mirai)", "value": "1b0438766aa5dee6d0db05a27d04669367a7305ea492b8b13209efd5d9552e279f86ba5d37f87e752fe5b5db1e849d8b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689560, "uuid": "99868134-96b2-4779-9cb9-d846deae113d", "value": "T13F146D85F243F5F6DC620534106FEB325E72B976613BDE86D3ACDA32AC01642891B6DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689560, "uuid": "47ca2034-7142-4586-b5a1-a7401a715fa5", "value": "3072:iamHFjTFf1kZUYXdVMFHo8qF69Zjv9TNbudVlXgE5FYDt0uNiD6:i9HFnFf14JdVMFHo8Uoz4w6ItxNiD6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764689560, "uuid": "a988d288-d0d7-4e15-8951-c25515ba468c", "value": 199272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764689560, "uuid": "010bb515-de69-4637-ba9e-d28e6dd8af19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689560, "uuid": "9383f242-0a95-49da-a6f9-8a6fcdd652b8", "value": "ecco.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f08d4185-cfc7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764711808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764711808, "uuid": "89b68a8d-6493-4b31-ab10-6c76934f138d", "comment": "Malware payload", "value": "3cf51f1de4b7a3f195eace04bbbd8cfa", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764711808, "uuid": "770a3f47-27f9-436c-a0bb-6bdadfd8ea4a", "comment": "Malware payload", "value": "9b33985b89bbe12f56726dc5f7650ce0f32466ed4895be848c1a27c498534f78", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764711808, "uuid": "3743a0fe-3a59-4183-8531-90a7b5f15c17", "comment": "Malware payload", "value": "eadb08a38050334e7815407cc76031cf7969d59c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764711808, "uuid": "09546cad-3983-4611-96b6-369d788dc8d5", "comment": "Malware payload", "value": "787eb15e1691b53227f15773949ee15be231b7a706446e53600e381db7aca183fda85e2d309ce85359096aadc6c92a9e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764711808, "uuid": "6fa0bc91-cccd-4800-aaf5-baea896fe37a", "value": "T154E0DFB0A6E8AC913824877A763520D0ACE78993512E8CBE60D35C748F3C921591BBE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764711808, "uuid": "a56f753d-f438-46c8-b1df-39571846ce46", "value": "6:h7M3d77lgNVUQnigTCpkME5hKn8cDFXM3d77lTUVUQnigMTKRFMx8cDFD:K3dPWDJSpkMkhKc3dPRSJSEFMN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764711808, "uuid": "cf800640-ac4c-4701-a0f4-8ec56cda5df3", "value": 340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764711808, "uuid": "7a7fbe33-2d6e-4508-9d42-b9ba0b82329f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764711808, "uuid": "5b0ac745-4c7f-4232-a45e-867f6062413a", "value": "b.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcf1fab5-cf65-11f0-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1764669685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764669685, "uuid": "764c8a03-f185-4c16-8d13-7612ba0fe2ec", "comment": "Malware payload (PhantomStealer)", "value": "01eff61a41eba2a117721c8a81cae1b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764669685, "uuid": "ac9dddcc-a9cf-43e1-8f4e-f06d342f79cb", "comment": "Malware payload (PhantomStealer)", "value": "9b408419a6d88f9bf77d0a32d260ced5789afaf3a0ee5374528c142d7c368f90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764669685, "uuid": "8211edac-28b0-4cb9-8ac7-969635d379f4", "comment": "Malware payload (PhantomStealer)", "value": "8ac5ce9b3fb90c2d6119855b87088ca8444da01f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764669685, "uuid": "47e1e395-6d38-4d75-8d18-a7118be318b2", "comment": "Malware payload (PhantomStealer)", "value": "223079ef00fa42315884d84eef6ef856111f02b7e9ba20b509e80356aa794e86c15e373627b5cab00435f0587a072b76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764669685, "uuid": "5d341398-4dd8-4834-8081-543ce9c47274", "value": "T1F375E0027391D062FFAB91334FA6F6125ABC79260123E62F13981D79BD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764669685, "uuid": "86e98406-4417-45a3-85ae-24dbecd2935f", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764669685, "uuid": "db2a3714-f592-49ff-b01d-b57824050cb0", "value": "49152:5PVt/LZeJbInQRaz/t+S/kzgAKjxF2gC2A2:5TYbInQMoS/kzgBj/2gtA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764669685, "uuid": "4e9cc5f9-2aa6-4202-bf65-d3f55ee6d942", "value": 1648640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764669685, "uuid": "5743b487-8263-4797-82f0-2b8b0684932a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764669685, "uuid": "c2b66db3-ce59-408d-a293-ce4239f18b26", "value": "Vendor 012433 PO 00013491049.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7111eff0-cf58-11f0-a129-42010a9c0007", "comment": "Malware payload (Amadey)", "timestamp": 1764663920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764663920, "uuid": "6b44b5fb-4f1a-49fe-b706-a8a60ccf1a05", "comment": "Malware payload (Amadey)", "value": "086294773f43035c3302893954deec2c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764663920, "uuid": "fb9a97f3-ce72-4218-8ac6-7039e74a2e3e", "comment": "Malware payload (Amadey)", "value": "9b7ebcd4b27ace0f237f2ccab58503340be62a43112f9c537d16f42d40abb715", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764663920, "uuid": "276364b3-40b0-4015-942c-71d943a4f8a7", "comment": "Malware payload (Amadey)", "value": "c26bed76b02a1c356dc88b62193dabd1f71e17da", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764663920, "uuid": "9575cd42-317b-4205-a672-6f1652260f6d", "comment": "Malware payload (Amadey)", "value": "ed5763d5d835cec7fcac873a91f9a5c886c6b17cec380755126517d7287e8663ec95793164dcca86f645598e6607213b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764663920, "uuid": "370f6bad-f748-4176-803d-d77fb8d12818", "value": "T107F4F19B73E530F8E2A68635C8514A15E7B6F4720A259F9F03E046A91F637D04D3EF22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764663920, "uuid": "3473e312-3334-4d15-8e57-78d30d21432d", "value": "6e5b678b6d8244f4b2920ca2801b6b89", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764663920, "uuid": "6b3c5646-e69a-4e63-94ff-b0e46e2dff32", "value": "12288:GUrQmKQxsUCWn0vlIHTkAd4OnRGZh/ls+w/stQPn8LZCe+gntFdygA4b:GU0Ust1KoAd4U0NrwEtK8LgrsPdyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764663920, "uuid": "9f0a3fcf-e9ed-42c8-b397-399e26f3ea05", "value": 723968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764663920, "uuid": "7ff507c0-516c-47e6-b60b-32d830d9fce2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764663920, "uuid": "418f37d7-6014-4946-916f-121038dae291", "value": "4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d09df56-cfbb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764706407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764706407, "uuid": "07a42212-d7bc-4d78-bef8-56f6ed91f5d6", "comment": "Malware payload", "value": "f10906f22c48ad180bb18d2b35626e01", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764706407, "uuid": "8134e3ae-c889-43e1-bea3-aef150beb95e", "comment": "Malware payload", "value": "9bdbfd3ceb1dbb45c3daa1cbfdf31dac1f08baea964ef7631d86d8470a252015", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764706407, "uuid": "67c652cc-a4a2-4139-9018-4d28e37de881", "comment": "Malware payload", "value": "66c2695fa2671f2e5bd5ba7e71e6f7f077cd8494", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764706407, "uuid": "1f7ee184-97fc-4d3c-9821-cee85a1675d4", "comment": "Malware payload", "value": "2b1404812499ac09fd5ee0651ebe6ced44c249e217b4df4cae410ae9722831084b0988d1ab0696b026369db6faacfda1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764706407, "uuid": "43b8265d-403a-4bca-8679-99258b363279", "value": "T1963144C82162843728A59927B2FB8E94F9E05D6168C89E585DDC3CF894CCE4CF874BC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764706407, "uuid": "5e9fd6ac-6fb2-4abb-a296-9d1bc887522e", "value": "24:v/fns/QjQ2CE/sKXj/EJ/rtk/q5L/yK/0Pks/kj/CN/7u/8B76:vMKESGBkYLwJ64Kz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764706407, "uuid": "6e903fcb-e769-4bf6-ad3a-90cbc77de986", "value": 1760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764706407, "uuid": "62f62f07-93e8-4ab2-aa09-614cc509a23b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764706407, "uuid": "3326a7fd-1424-4e59-937f-3a546c2d60b7", "value": "fentbins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9abe82e0-cf5b-11f0-a129-42010a9c0007", "comment": "Malware payload (DarkTortilla)", "timestamp": 1764665279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665279, "uuid": "8ed071df-8088-424f-a8b2-6c6e4ec540d7", "comment": "Malware payload (DarkTortilla)", "value": "49a8fefe9eb5eaa59e2da51833ea1d0a", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665279, "uuid": "5dbdaa60-8de8-4c1a-96c4-d1f4c425d93f", "comment": "Malware payload (DarkTortilla)", "value": "9cc00b1af48acb7af7f3c53d0a1adbe928d4bda26273dd955120ca138bdf2eca", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665279, "uuid": "998e49c2-8a1f-4254-95b6-8652534a65fc", "comment": "Malware payload (DarkTortilla)", "value": "c8d5b3a9f6a2afadbfda3dc2ce539d6ae171f957", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665279, "uuid": "3b6bf495-576a-4a38-8f10-5f6cf10f9af0", "comment": "Malware payload (DarkTortilla)", "value": "3c9eb912681a303a43f8b1766576dcc0d5685063f82715e5c996d19c9599121fd058a7ddd3a6a986f2f306700b4850f2", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665279, "uuid": "77c4ec1d-a317-41d1-a6ce-fb1a8ced96de", "value": "T152F4BD2423EC5A08F5FF6B39697415040BF1BC269A32DA2EAE5650DE0EB5F80DD61733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665279, "uuid": "210d735f-6cf8-4c0f-a988-75770c0bd70d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665279, "uuid": "2ddf8ba1-db07-4867-9cca-6750fb8cc963", "value": "12288:nCWZ0Lpr9YtQZZzdCJvkx4uDsBVzlaDSNd7GPbv1b9iTQgm2Cauzu9Cp:edZZzdCJvkYzllNkPbdb9tV2CB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764665279, "uuid": "7926329c-cb82-4250-8d02-40010a238786", "value": 748544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764665279, "uuid": "dfd68840-c74f-4168-a773-79588db468bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665279, "uuid": "636b066e-9766-4dcb-944c-c8bd256e213f", "value": "QUOTATION_______________PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7451e13a-cf3c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764651900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764651900, "uuid": "898eb16b-219c-4b9a-b4fa-68f1287232c1", "comment": "Malware payload (Mirai)", "value": "332ba4a23aca414add96f29fc5ceb73f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764651900, "uuid": "f8bdb3a4-a9e0-4817-9de5-529e9545d65d", "comment": "Malware payload (Mirai)", "value": "9e01cdb5054d1a8b33b14f8169b405305a320c562a01a817d762f46b9b3183d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764651900, "uuid": "a3d5869c-e654-4bbf-846d-6c1d45f602c3", "comment": "Malware payload (Mirai)", "value": "cc0f424c208c411cdec0c0093cc9c5b3a89c0e93", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764651900, "uuid": "8bd58f5a-9925-429f-a252-6dd92de7c209", "comment": "Malware payload (Mirai)", "value": "db5e75d36d88bf78d69fc3b06f6f908c2fb41a5334613c727fcc689aba577d0506cd0447878a25147ea93b61ff122da8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764651900, "uuid": "c69d0e46-c9b3-43fe-8475-5a278dbe74a5", "value": "T1A3E32945F890DF17C5C2667BFB4E43CD372A17A8D2EEB20399255F21379A95B0E3A102", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764651900, "uuid": "36328640-7d52-4bc4-85b3-9c217f4755ee", "value": "3072:/N+f6FDQfbCd8MQ4SQghFYITBRcr7B2VhP:EfcDQfbATQ4SLhFY+BygVhP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764651900, "uuid": "99e69b7c-93d0-4572-ac4f-7747f6f5e4ff", "value": 153456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764651900, "uuid": "5f30c28c-0b00-4a58-aea8-98fe6a68aa0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764651900, "uuid": "6a2249ec-a8ac-4c55-8924-e386b809927e", "value": "gang.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a5041d8-cf2f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764646246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646246, "uuid": "9d09da77-d175-40bc-a1a1-6db88c62c48d", "comment": "Malware payload (Mirai)", "value": "520c6be0f2c2233604e3c3848f5cdf32", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646246, "uuid": "594b57f7-187f-4a87-848a-767fa52bcac6", "comment": "Malware payload (Mirai)", "value": "9ea1833b741035d37d2aa042af2e0bea73df465d37b31f525fd3d713e3fa3e55", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646246, "uuid": "2bffebb1-94fa-4f98-8813-b21dfd4a373c", "comment": "Malware payload (Mirai)", "value": "457db2b2b0777077ba5de4102db8a51e40f9b432", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646246, "uuid": "cb2108a9-516e-4c12-b9ef-8649857379c1", "comment": "Malware payload (Mirai)", "value": "3624324c5a97d9009f7473cc7d4d454dd049cd294ef797ea39f83d5524ab81909eaad40fb2a1b38bdcb2c3c934a05e05", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646246, "uuid": "e9554a85-147b-4d8c-9e02-48431fee51ee", "value": "T17B535921797A2F17C4E8A07A25B38325B6B5768E32B8C65D7C732F4EFF14640A0075B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646246, "uuid": "785b43f3-1873-4761-bcc6-bc5a4dd1376a", "value": "1536:k+YY8/acYmgBOwicSYmnWLI1fz/A0LzpOpdYm+K:n2DZYmnFxoYpUr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764646246, "uuid": "c8dd1e54-fb1a-4e81-88a0-835c64bd597a", "value": 64400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764646246, "uuid": "8da8de60-d4f4-42e7-85f4-1b0348054826", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646246, "uuid": "5348fadb-8a1e-400b-9617-a5e26ea0ae61", "value": "jew.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8075aa26-cf99-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764691864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764691864, "uuid": "f96fc4c4-c5fb-4d32-83b8-10c251bd02a8", "comment": "Malware payload (Mirai)", "value": "b848a7a6f4791d5018f24599fda8dd93", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764691864, "uuid": "b1136a77-4b69-4da5-a824-81442bb254b9", "comment": "Malware payload (Mirai)", "value": "9ec901f5715108058cecff22e5a3cf986a9a0a730eae82f04186d9b94afb3dfb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764691864, "uuid": "8280cf05-5110-41fa-a9bd-c23cf014f9ff", "comment": "Malware payload (Mirai)", "value": "f2fc36e24094f7c67a08db1c9c024323b6ffb7d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764691864, "uuid": "7304fe86-d2f1-47ea-9b3c-e4d2c1a870f9", "comment": "Malware payload (Mirai)", "value": "bbe589d7206def69f45eb009e9aa37502cbee386ee58c211fd2a660294f6dddd3b6b94580613a37869b8482eaa090a1d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764691864, "uuid": "b5b68014-0484-41da-af98-98fc5d485272", "value": "T1AF8302C6B70C18C0FA773F543EE19EEE764B1A814DC32C15A3E61F539622456851CAEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764691864, "uuid": "e29d32c4-5935-4b8c-9ae9-8396416972f3", "value": "1536:ZevBHTj3JiTZx6taz0mGX1xMHjkyOZ8WzmWCJ+nNVCfkHswui84NKT4u+qgw09H:ZevBzj5AZI1lxMHYpnbtNVZswui84ET0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764691864, "uuid": "b83ee27e-3849-4bc7-9116-f13bd56f0e89", "value": 82760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764691864, "uuid": "c8029ba0-0afc-4e16-aec0-591f448d4088", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764691864, "uuid": "d12674d3-7fb5-4618-b686-dbfa912a757d", "value": "ecco.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eda29112-cf70-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764674437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764674437, "uuid": "f5dc170a-0706-4256-8deb-b121f0a6cd46", "comment": "Malware payload (Mirai)", "value": "eaa1bef98d4eef767a5973b6098fe547", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764674437, "uuid": "87264d13-ce8d-40c0-9a1e-6a2bfa6c4623", "comment": "Malware payload (Mirai)", "value": "9fcb6fb4e42d1848a2cc46430f27d36f3d6346cc57e7cce51f6905ac43fc2aae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764674437, "uuid": "ef1244a8-b06b-45f6-925b-c7b7f5387975", "comment": "Malware payload (Mirai)", "value": "a3441dd0521fcbc02d15b9a9ac14959e2c207826", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764674437, "uuid": "7917a9b9-77a3-4f9b-8cd3-a81373ceff66", "comment": "Malware payload (Mirai)", "value": "6832acc00ec6f01f89a8d8d8f04cb1d92ce3c57b98887fd6526aae8f102e1ba2385f839c1102295b021cdca91ab30c0c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764674437, "uuid": "0eeb43d9-7b0d-44bd-be38-c5f2e79c2f2b", "value": "T1DE5302878AF18F01D364323AEF3B37932C29E1614DA4D1E7E6CEB83589917B03364255", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764674437, "uuid": "0efd84ab-8e63-4638-8e0d-b61db8045f2f", "value": "1536:T/7fF+k5rFgYRK6FGzxRMfzkX2rYnouy8Ky/:T/zFyYRK6FGzxRMrkroutv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764674437, "uuid": "02b32480-fd18-4358-881b-e73a9cf84740", "value": 61772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764674437, "uuid": "6d886e16-2724-473c-966b-2ef1ec5d852b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764674437, "uuid": "c92ee6cc-9113-4abd-ab1b-09bf718db8f2", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6d76b85-cf2c-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764645167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764645167, "uuid": "dbf73a5c-b84e-4051-b1cb-a89373df05b6", "comment": "Malware payload (AsyncRAT)", "value": "fc104c64f831bc85d2dd8f9692da31a5", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764645167, "uuid": "a58e2a7b-512a-40dd-8e29-fbcfb9004c13", "comment": "Malware payload (AsyncRAT)", "value": "9fe7289e6e6eff48961ebe44aed0440e21d35702da284c34f4ef8c37b6ad7419", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764645167, "uuid": "35ddb61a-7981-4d80-8420-0d514363cf60", "comment": "Malware payload (AsyncRAT)", "value": "c452a8ace7b39e9bf31c7a90a7896c4acccd8d1a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764645167, "uuid": "7d59e459-d3ec-4461-986d-e4876e1c3e51", "comment": "Malware payload (AsyncRAT)", "value": "548337dc2010a8f7c62b0fcc429e391f94c68c08ebae5cd19d00021e6966b6eb6c1fa8529d62761048d7b9777a3a6cc5", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764645167, "uuid": "57c608ac-7b80-4552-8baf-dd0959f0650c", "value": "T16594F1647609E417D4AD5FB00831E272277AADADED11D18BAEC43E8FB9BA7845E01313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764645167, "uuid": "bdb4ba32-8b23-4c22-a1ab-f6e0de91eede", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764645167, "uuid": "a968dc11-0f75-440d-9885-0694bed6f926", "value": "12288:F60BBCdnT5hkdSJqftsFcljf4xxYKKalN7Lu/fB0BB:Hm9MdSJ6s4jUx0aKfe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764645167, "uuid": "404a3177-dde0-4260-9ed1-2f01c0256215", "value": 445440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764645167, "uuid": "3520d3fa-bfaf-48c3-a5ba-2e76d058bc3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764645167, "uuid": "50ecfeff-c1f0-43cb-89fd-164b09ed6737", "value": "PL-RA- PVP7 12 15 PV5510 10 12 PV5310 9 12 20251204-01.xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5683350d-cfaf-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764701242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764701242, "uuid": "52bb785c-1ffc-4c3d-b2c8-ae93be09e037", "comment": "Malware payload", "value": "950965802ae47982d6c406f82777e49b", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764701242, "uuid": "02dafcde-b300-47bb-b2f5-b100369547fc", "comment": "Malware payload", "value": "9ff0db8efd0060e7194975ae5174a399a6b2cbffdaeb2f3f23244d0cce50b7b6", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764701242, "uuid": "5ebfe8e9-004e-4dd8-ad98-95711a3e149b", "comment": "Malware payload", "value": "720e433f088e6ea59bfef65ec4559cce16ae253f", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764701242, "uuid": "637d5087-ee48-4622-8d95-1a2b6e08d9df", "comment": "Malware payload", "value": "e36c643a52a0a0f57914c2e3d515bb835395214d9addeec0f77a93bd80226246e066d5a132c3aed66dbcd52a31bb0703", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764701242, "uuid": "79d68576-414c-43ab-b142-c108641f5fd9", "value": "T1E89533636BF40432DE752BB408F992970FB7BDE14CA5C66B724A9A850C33206E476377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764701242, "uuid": "7cd01595-501f-413d-8f82-6892f7e926c8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764701242, "uuid": "8053da3e-4097-472a-aefe-8ea1dc2e45ed", "value": "49152:AaY7bD2TEK3rhOYfn6LrOmOBDYLJSP2/Ue3xQ/:pcbCeJn9cDT+d3xQ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764701242, "uuid": "4d1935a5-18d4-4ef2-89b8-5fd00aa10262", "value": 2002312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764701242, "uuid": "5ebe3b09-026b-4168-9a56-a88d4f51367d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764701242, "uuid": "78189326-83ce-44b0-88ab-86386ffb02b8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "963ca8af-cf2f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764646373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646373, "uuid": "485cab23-f414-48be-87b7-157aa8af7c88", "comment": "Malware payload (Mirai)", "value": "b49d87c841295ea231c6c2afc4cb5fcf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646373, "uuid": "6a739570-f8fc-43be-b1a2-6be130e3f644", "comment": "Malware payload (Mirai)", "value": "a11d9869b6887d0b74fd923c55a7b0e3bc745cf4500c0d15da2b4fe40d7522f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646373, "uuid": "3ab1f0c2-9c5b-4af6-bb6e-e419431d53b0", "comment": "Malware payload (Mirai)", "value": "a6a31799ea24c261aa0d14e660ebb3a599e4bac3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646373, "uuid": "fc1e1568-1d01-4d57-99b1-35cd3608133b", "comment": "Malware payload (Mirai)", "value": "91ca2096910d8208743ceeb0cd5fea0f5559d263b466daf8ecd5c1dc34076444cac0a54dde72b244f1992f425f69a37a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646373, "uuid": "ed16f9ce-39f8-4c15-a6e4-9f747b6f0d5f", "value": "T1F44308817881A626C7D05377FE6F018D3319A798E1EA33538C251F957B8AC1F0E6B74A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646373, "uuid": "2962dd95-51c3-4382-92f7-14670f099820", "value": "768:JuW5xE+p9ozmnu7+lKPCXBNUOJdw1lod8p7khDCZVfKIhCLwCVy/Jx+5H8hG1rma:z55EzOPdw1hWCZVfKqoeZW+mGleYr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764646373, "uuid": "08e542f6-1dbb-43f0-be1f-e5848548315a", "value": 55688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764646373, "uuid": "a985d22f-d5ff-4224-9a91-f1d0d3c78b17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646373, "uuid": "0c0932a6-8277-433a-9038-2e6ad3b99550", "value": "3atoNational.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19f5a218-cf49-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764657332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657332, "uuid": "63434e4b-f012-4bb6-9419-9679dbc7e75d", "comment": "Malware payload (Mirai)", "value": "640c23e8a16f20a47d14c041aad92e9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657332, "uuid": "048e8d3e-e247-49a0-b58e-91fa39fb3774", "comment": "Malware payload (Mirai)", "value": "a255d4cb5323c81dcce297acf7c78c636d188078b971dc208c126986dacf5fa9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657332, "uuid": "58307683-a2d6-40f9-b050-0da75ccef0ba", "comment": "Malware payload (Mirai)", "value": "7a68e07bc6865f8a69a201b20afd545ec7edd5a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657332, "uuid": "5ae0e660-76f0-4e72-925b-43bfdcbbb1c5", "comment": "Malware payload (Mirai)", "value": "b86743a60b8cced14fe0b4c1c610ee7fa8e50c7060a755c5140e6687e0d60ed60e11892e235204ee4a42a449bdf35d43", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657332, "uuid": "db20e891-6456-4c27-83a6-75ddfed58df7", "value": "T1A4C3295AFC819B06D5D522BAFE1E118D331327BCE3EE7112DD246F2137CA91B0A7A502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657332, "uuid": "ddde12b6-9572-439d-8ca9-11c5e1307e39", "value": "3072:v+/IbpilIt6dilb6aX7BGxzjafCVAPjq0PQ6aGyBh:v+/IFilIt6dilb6aFGpjafCVAPjzPBY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764657332, "uuid": "8ac4ac11-c227-4184-aab2-d8f621ef3c8a", "value": 120456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764657332, "uuid": "72fdc6a5-22de-470b-bce2-58f2796fd3b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657332, "uuid": "23e9460d-f14f-4a40-af0b-dd82ca9ea027", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71b10788-cf45-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764655761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764655761, "uuid": "0527fe34-3483-4ba4-83d6-ba9c58a909d9", "comment": "Malware payload (Mirai)", "value": "6e9bf297a54bc038304badfcebc19f6c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764655761, "uuid": "04013461-b525-40de-b690-a21d08013519", "comment": "Malware payload (Mirai)", "value": "a260329c242d17354cb0ef59703137d467a9a82aa395753404058ef7222b1099", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764655761, "uuid": "52ddb3ee-303d-4699-bab8-41379781da9e", "comment": "Malware payload (Mirai)", "value": "2f356e5b0637f560256306875c5854782a5196c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764655761, "uuid": "78b95aad-87b0-4fad-9265-c4f772706858", "comment": "Malware payload (Mirai)", "value": "aa9f3eb61d7ed13fb33bd4685dcd04128ba8946b25355abd6ad7631044f1ee0ebf8f268d24a185d48e28e81f8fda5d1e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764655761, "uuid": "77bf83f6-9f25-4d49-baba-7f151d950ddf", "value": "T1162329017982DABBE44317F582E78B211631F93E2B528D0AE35D7CB4EB1B184B25376D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764655761, "uuid": "05c3afad-7556-455a-84fe-9a0e4d1d74cc", "value": "768:2F51/Z38p5XmrDZWrvLHys+a4P2JLOGgvrBNIue3:2FereYrjHyha2SNgvHe3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764655761, "uuid": "1d92d72e-942b-4336-b40b-a20dc104ce20", "value": 49361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764655761, "uuid": "cc6b67c5-16e0-42ed-9139-507725c3c861", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764655761, "uuid": "22ec2d2a-be36-459e-91ec-c3077f5a6d53", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bdaad99-cf99-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764691883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764691883, "uuid": "86f7f14f-a55e-42c8-ad86-06025ad06130", "comment": "Malware payload (Mirai)", "value": "7fef445fa3ddddd26fc07f39ac6fcf0c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764691883, "uuid": "d7d6de65-29e4-4e79-a560-00be9a63d4d6", "comment": "Malware payload (Mirai)", "value": "a2921927a78f06aeb21454f6e6e6703166d6f573be89d767771af1411ad431f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764691883, "uuid": "a778a96f-5576-4722-bb57-4f5ff97f9113", "comment": "Malware payload (Mirai)", "value": "652b04d3e1c7d91c476607c3fc480a8728b01107", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764691883, "uuid": "f01ce1a8-f8a8-4745-b06e-367491062896", "comment": "Malware payload (Mirai)", "value": "13f32795e8cc898c8c1f255dc7219c5ab90b87277441c563a1c47ab0a6281f17095d9e99509cf66cfe10637e3cc1feeb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764691883, "uuid": "d82d82da-46e9-419e-ad6c-511c3a040315", "value": "T184445B02B72D0D43D1A31EF0273F9BE5A7EFD58220E1B581395F9A4A9176E370949EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764691883, "uuid": "2ee29e99-f52f-474d-ade7-098142938ffd", "value": "3072:RB8Kx7mTj9tuiQ6iK4cQhAxeJFoTueHAV+W6Eo6hh1xyqxywh9:RBrH9K2hAxeJmTueHs+Wzxywh9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764691883, "uuid": "451fc9dd-8c82-4600-bc3d-de21ba1d777e", "value": 257060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764691883, "uuid": "f6f1d999-aefb-4095-8ebe-b1551f0ee098", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764691883, "uuid": "87ebf9c0-a9db-4e57-b130-d034b3fd34b6", "value": "ecco.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c315f8f-cf5b-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1764665228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665228, "uuid": "386db6a7-c687-4013-9bb7-d945a66e0d64", "comment": "Malware payload (AgentTesla)", "value": "8628f2ba198911d9f9a58f02c3142d34", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665228, "uuid": "270ab7b7-c358-40bc-b3f5-cba810699b7c", "comment": "Malware payload (AgentTesla)", "value": "a2e39401f7e09438f35e9a4ca0ce24dafbfef8c0b6250170f67fb9a4dfc0b63e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665228, "uuid": "aa208d1d-3d13-4ea9-bf82-b540ceb57828", "comment": "Malware payload (AgentTesla)", "value": "0ad870f535ccf22804a1136690671f570dbc615f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665228, "uuid": "2ca4e400-349e-458e-9576-fcfa1ce3521a", "comment": "Malware payload (AgentTesla)", "value": "338c4c35d88e9e566946ca5daae73659a1f45bf73003026df232704926e0b2f8a082d9c1ae9c08c3c26d3e7136684c44", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665228, "uuid": "331d534f-ee30-4f50-8bb6-32287a7552d4", "value": "T14CD412B01718CD23E8A96F720AB0E33197B15D9DE422D192CBDE9DFF7603B156C88661", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665228, "uuid": "56f156d7-879f-44f6-a299-49e333d34107", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665228, "uuid": "3a8cf8ec-8126-472d-8708-cb406677a133", "value": "12288:Ewk0sIrqQrV5xDWKhouVWH3Rdrrc6R/fftrYPUf9q:s0L75mndrLR/ffFiY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764665228, "uuid": "f0917d54-7e3d-4c4d-8a46-99c6f18122b1", "value": 619008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764665228, "uuid": "69711ccf-41d7-4f32-a9a8-f0849578c373", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665228, "uuid": "eac8fe93-82b7-41b5-8ec8-d3c9b2d1f72e", "value": "enqu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1d9089f-cf9f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764694577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764694577, "uuid": "99fc9390-48bf-4ea2-b7bc-24c55d937583", "comment": "Malware payload", "value": "6c2dd8f8adda995995e2b216fd0b974c", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764694577, "uuid": "047e5d06-f600-448f-9fc5-e9e592c126e8", "comment": "Malware payload", "value": "a30808cce19d913713a91e8a2df05458eceb3301a687c5c30f85c2eee7f275ee", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764694577, "uuid": "d23568c8-8743-4ea2-9768-3b42484d1954", "comment": "Malware payload", "value": "8e9cdf9832af319957888b5c3e154987e6f5eaeb", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764694577, "uuid": "8a000fc4-f6f5-43fc-9e00-eb6d70c64235", "comment": "Malware payload", "value": "a64d263b9b1e2a05463f6408ef7a950ee7bd9497d8f0d65bf2583db8875e7c2103781071c29e6b72a912ac0ab0fd38c8", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764694577, "uuid": "bda108ae-db37-4bad-9da8-dfad6d01ca59", "value": "T19373319809DBD4F89623F9D989DF4E42FBE98507152CD9D5BE4CB9E02F0043892F49E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764694577, "uuid": "577937a9-93f1-48c5-bcd2-8264c9745ce5", "value": "768:RyHY7RQCEbI4Envfcv9KE1fsIkHfviOSbI2n3qeNv2AfFICf1GFOwQpkpqNrqI0W:hjQ9K9QIgX1Y/OqAW7iYvcKep0i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764694577, "uuid": "1d664f96-05b5-4d2a-8286-87788f9bc3d7", "value": 76648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764694577, "uuid": "72957eff-49dc-437f-8dc2-7763a08b33a6", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764694577, "uuid": "96f21b5c-84dc-41c7-908f-fc85b06cd49b", "value": "1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1809cd8c-cf49-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764657329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657329, "uuid": "041a0dca-04bb-4f1c-ae21-70fbca2d8408", "comment": "Malware payload (Mirai)", "value": "d22b7808809e0f08bc9924972c52a6f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657329, "uuid": "83b4edee-76c1-4ed6-906c-2c578f9fd23f", "comment": "Malware payload (Mirai)", "value": "a398c1725664374d42ec6100489aa11446c6e99dbc545ea9ad528a114202b75f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657329, "uuid": "a23e9c70-fea6-4491-81d6-35c4fa59af7d", "comment": "Malware payload (Mirai)", "value": "5af717fc6c53756624a2e7a9c21c2036c9f1c7bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657329, "uuid": "e249a640-2196-4346-9892-70d9a0c04535", "comment": "Malware payload (Mirai)", "value": "a65a9c5f712f3fce744eb554a99f2a4f29ca6c88771d600a37b2e260cd05ba8a84509a20a8ac8dc963796e797cd58688", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657329, "uuid": "8d7b63ce-6411-44d6-93b2-7e4ca72051da", "value": "T1A7C3C50F7E228F7DF7A4C63807BB4D35979D23C622D1C685D1ACE6151E6024E642FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657329, "uuid": "3c094581-53f8-468d-9db2-5570e66be767", "value": "3072:1571l8cIiT6Smbpf2wlVlTD90An2vsSe3D9weBKOj:D1Kc3E2QPTD97njvTwOj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764657329, "uuid": "c7d342be-da63-4295-b559-86178a7b7de9", "value": 121460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764657329, "uuid": "416efd06-a033-44ae-bf87-ff2980675dae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657329, "uuid": "a2f1abe4-a48f-4eb2-adfe-73901eb70de5", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96a997a4-cf5a-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1764664843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764664843, "uuid": "0f068491-6a04-4f9d-a1e5-b720799961b0", "comment": "Malware payload (AgentTesla)", "value": "cfbb74dda04f7830ce4c4044482eb246", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764664843, "uuid": "191c1076-7650-4fde-b6e1-858a0a1d7441", "comment": "Malware payload (AgentTesla)", "value": "a515fd4ef2d7b5c1d60af04da2e2138036f493ce5d02d1491354560b718f80ce", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764664843, "uuid": "f9718ba9-afe0-42f5-8970-a5852ab1dddb", "comment": "Malware payload (AgentTesla)", "value": "8588e7948fda127e80f3993cd800d99d8dd6c72b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764664843, "uuid": "fdbf9ad5-d7fd-4c9c-9226-c4830d181c1a", "comment": "Malware payload (AgentTesla)", "value": "d0d9df5b86525b528098f7c27919b97d0059f0e68d81df5e23b0e3bbc781198951bac7a412021944a66736af531456ce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764664843, "uuid": "4fafe0ae-a73e-4860-aaa7-ff1a52b13fe7", "value": "T12225CF681EE5DC4BC3921E744CF1E739567D8FA17C5A92039EE23DDEBA78B8C2940241", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764664843, "uuid": "a8bb7e19-59b8-449d-aa06-6a4d8320f8ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764664843, "uuid": "38c0777e-11e6-4512-b3d8-ecc7f3e3ccdc", "value": "12288:cdnT5dJ0laQJU0eG4jKL8SUxg2MOGB+EjE87m3Y1Tu23DugQFD1nerTxAj2b62ht:c9casp4jLxJVmE87AY1z5QnQNPtht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764664843, "uuid": "797896a8-9f01-4ef9-b5b1-aee94de96710", "value": 991744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764664843, "uuid": "2bf98b51-e53e-4a3e-8754-e4973324bb7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764664843, "uuid": "13ad0950-9894-465c-b683-7397f4941161", "value": "Swift copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dc6c64d-cf99-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764691886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764691886, "uuid": "6c6dd79d-f76e-4c7c-a307-8f3d8f47419a", "comment": "Malware payload (Mirai)", "value": "8a4a5d51a7df3036be7ca614a8589492", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764691886, "uuid": "73ef9cd2-eaab-4c8b-9e95-b9b33b8c86d1", "comment": "Malware payload (Mirai)", "value": "a530820d2938990492e2bd5f45fffd6ba382592616cb0700358bad9b5b868158", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764691886, "uuid": "817ec5ce-3f05-4f0a-b565-2a1a926c0bb1", "comment": "Malware payload (Mirai)", "value": "671536ae7638deb628aeb769b49ff893bb400bd0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764691886, "uuid": "2647ffb0-cee8-4dfd-8ff6-17f6fbabe09b", "comment": "Malware payload (Mirai)", "value": "614a873fab9e31cd5c575ef28316d7181b0dd86935babb76d0f42ffe7ec951f732ee17941b6339ed10d172f0cb76499c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764691886, "uuid": "9632241f-3ebd-420d-a1cc-93afb5a2df2e", "value": "T1D7246C92E243E1F6DC420D35501BFF365E72957A6127DE92E7ACC6369C06602C22B7EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764691886, "uuid": "a2eda256-9fb8-460b-af18-dc4cffdd8f46", "value": "3072:9kvrJpeOcXBH4B5Dkp25uflFGgmUsxEuEMjJSJuaLB4ZD4hGB1vYoC3:9GXenXBHs9kp2gTDP6c+ZDVC3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764691886, "uuid": "1eb72b11-fcfc-4720-9564-0cd9cd56fc04", "value": 223848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764691886, "uuid": "908b2763-75fa-4c7e-a2be-524d4a93c282", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764691886, "uuid": "5d4e9468-5753-4d11-85ff-150418612d2a", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13994a98-cf49-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764657321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657321, "uuid": "ec15336d-d3e2-472f-b5d4-4eeaaf579a4a", "comment": "Malware payload (Mirai)", "value": "dd3c742b4b2fed57145d48cb43aaf22c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657321, "uuid": "8cf9179d-bc67-48c9-8423-ccb2a9094688", "comment": "Malware payload (Mirai)", "value": "a533cb8d154674608608901d56604a33cd1a3425736685e1601b3e4fab2b7295", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657321, "uuid": "d0763a72-6612-4d0d-b60a-dd3657b2c498", "comment": "Malware payload (Mirai)", "value": "90c4ce0edd95e2b144d5bae3ef8d4ab1294ec603", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657321, "uuid": "4f61408f-6e52-4040-812d-1afa088f65b2", "comment": "Malware payload (Mirai)", "value": "1bf9fa6bdd2c61ef5d72df9c52eefd4dfe3851ec6c7b5deb9ffbfc71170953b521879897a8a0e4d366f243bc0d2d1097", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657321, "uuid": "e6c07cdb-0b1f-4e71-bdae-39499d419a02", "value": "T16EC012E9002A21E2C002BF00B2A0D4249011F3E022D28ACA9E0C6824F2CC8F03400E49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657321, "uuid": "2d2d87ec-6d1b-423c-9e7f-8bfc99eca69c", "value": "3:LMFnuXS0VeBzSa7N/xhWRFnuXS0V9f3zSalvW/xveN:LMFnuXSsez/xhWRFnuXSslVmxK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764657321, "uuid": "9b09043c-64ca-449e-abf3-e5313116d2dd", "value": 164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764657321, "uuid": "f0736c66-11c8-410c-9c32-c16ae39e7a4c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657321, "uuid": "fc32b613-b653-4efd-abed-317ae135366f", "value": "b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "890dc945-cf5b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764665249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665249, "uuid": "f76abe57-ea1c-4456-8b92-55f992395cf7", "comment": "Malware payload", "value": "8dc232ce0f24dc0a3ed84a86448f5e20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665249, "uuid": "c23b2663-81e7-4183-b601-2dbeebddc2ea", "comment": "Malware payload", "value": "a6644d304e2c966ce784d5b3814eda24ec861839cf52d4c315c5e600fa4d4454", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665249, "uuid": "df0e80d3-da6a-4c30-9111-260f14bd956d", "comment": "Malware payload", "value": "bcd05dd83452167e642853418ef493b83aeb3dfc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665249, "uuid": "9ae14a10-5d70-4c65-ac4c-af59accbc0c1", "comment": "Malware payload", "value": "4bb65f9429c9e585d4850bbd7fea46877205ad65ad31fc34cc123431e7507c9552c3687672d8acd17b092688004197ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665249, "uuid": "66fb1d62-4f02-4c4e-949d-29d90d138ffa", "value": "T13A94E0A1F749C8AADC9113788837ED2B21A3FC7954B4451F525E7639AF7338310AB90B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665249, "uuid": "313d2414-3922-47c1-8a3e-7bd453185d9e", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665249, "uuid": "d654ffdc-3e31-4671-9ee1-525980655bee", "value": "6144:1+MvoJieOEYsF5cfzWC8LwsNUGgoMdIMLAm1:1+mIXYj8LZ3ZM3Am1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764665249, "uuid": "7ac5b780-2d12-49e3-bdda-bad1ee9479fe", "value": 413316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764665249, "uuid": "0f603a03-3618-4b1b-9cc7-6bc01aecb0da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665249, "uuid": "2710111d-d7c2-4be1-a1a3-d136384d250d", "value": "Klukkenes.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb43afd8-cf4e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764659830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764659830, "uuid": "44d0e208-d9a2-4b3d-a6c2-5ea9a7a97db9", "comment": "Malware payload", "value": "9ea1985faf04aa3bbd9336ad88d62251", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Dongguan-Yingping-Technology-Co-Ltd", "colour": "#8D887F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764659830, "uuid": "808dabda-524f-4023-9813-62df9506202c", "comment": "Malware payload", "value": "a66cd899031a0687dde6bc5ad754e95e9d6e19ab9e20a975f9f37a28eb378ed6", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Dongguan-Yingping-Technology-Co-Ltd", "colour": "#8D887F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764659830, "uuid": "59d11a8e-af92-4844-bc25-bdcb6be70c80", "comment": "Malware payload", "value": "656e6672e547fdd2d49698bd2e18a0b94266b0db", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Dongguan-Yingping-Technology-Co-Ltd", "colour": "#8D887F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764659830, "uuid": "b301a279-1638-4e5b-8df6-e52ef90bb56e", "comment": "Malware payload", "value": "d2f3838ae4d0195531dd33e7f5d079ce39289fa0fe56c81fef62834d39badc9d443fab4e7cba99a6ea0dc7a36224475d", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Dongguan-Yingping-Technology-Co-Ltd", "colour": "#8D887F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764659830, "uuid": "b2037a0d-953e-4aac-bcbe-f29753a03c6e", "value": "T1F7F2F1CF5D1A2924F453F3F202D58D30B4E0B098EE8AE371259D5D97ABB0B04E19B12E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764659830, "uuid": "71dc27b8-a009-46a1-9e52-780e2ae21ba9", "value": "768:O6uxZeFnMwD0/VQKhd6rF5zdEr+NJwuOsAWlD+7q4idcP4a2Kf+HNqG:/IZeFnLJKDa/dI+7gWodiBtS+tx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764659830, "uuid": "f615c5ab-26fe-436b-beb3-d546c2aafd69", "value": 36238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764659830, "uuid": "bd4c8bdb-ac2f-44bf-8009-8169febe201b", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764659830, "uuid": "162d2313-83f5-4e2a-8f9c-cb61bcab3472", "value": "NewResume_Portfolio_2025.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7d4ba2e-cf70-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764674428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764674428, "uuid": "7c9eb815-48c1-4ed1-8d94-0d2a619efb59", "comment": "Malware payload (Mirai)", "value": "be70fd1dde175fedec0714ffa757043e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764674428, "uuid": "7d69805b-3744-4152-83d3-71ad4dbe0973", "comment": "Malware payload (Mirai)", "value": "a8ba3dc5b85e79bf27d9a4a3538458c1d3159bc53e385346fee6b15f2f07b57c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764674428, "uuid": "d7ed1624-32e7-4196-bfba-9a2f7198c495", "comment": "Malware payload (Mirai)", "value": "aef2e672c6de4ac5295e25929f1fc1aefa0d9e81", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764674428, "uuid": "4e45a0e1-e4da-461f-928c-ee0c5e3df206", "comment": "Malware payload (Mirai)", "value": "f3f7b6a61a888895842a922ae33dc02c4ab5b8da0ef1b101ef7ffbbe552995c76b97c146de33f5e325074c6670acdc23", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764674428, "uuid": "1bbdcc62-2e91-4f7d-b8a1-eb82deea331b", "value": "T13A24D90E6E319F7EF7A9837457B78E20939923C223D1D585E16CEA110E6024E741FF6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764674428, "uuid": "09fcfff6-b685-4b19-a672-852a12c5bad1", "value": "6144:7H9ESYAULYaee4ajL0w1VSw0VrVTFMG9Ozd1rIGLgIE+jWRKCtcNKlNdsnvFk8u+:LgdDScNrF6wf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764674428, "uuid": "7b351cb4-9e45-4cec-b9d1-59ddaf794824", "value": 223476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764674428, "uuid": "d333c5cb-126d-4b8d-92df-5f0cb97d564e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764674428, "uuid": "0f5efe3f-f9e8-4c3e-ba15-a172feb2088a", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b220ede3-cfa3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764696242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696242, "uuid": "dce0860d-829c-4e6f-a768-00bda86a58c0", "comment": "Malware payload (Mirai)", "value": "5b021fd3b26f867691d8219879c608b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696242, "uuid": "5f751d69-d151-4339-a74b-714d58cea6a4", "comment": "Malware payload (Mirai)", "value": "aa8a429a71d7bf5af2d076bb1cc7ca6e3ab37415eafb0b0e81a5a6c66baaeb2a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696242, "uuid": "b642949e-f00e-4818-8747-dd5212f05a86", "comment": "Malware payload (Mirai)", "value": "0af9dc3257d1bb5ddf82f89e906714564345131f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696242, "uuid": "9472b067-0d23-461e-a015-4862f7f517d5", "comment": "Malware payload (Mirai)", "value": "a03cef462b41f7cd5c569c4c02195d776006b110487ec17f3a59d7988350fc82dd45da9d632b32f728993dc46f01b87e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696242, "uuid": "f87a8886-008a-4b7a-90ab-404da171b00f", "value": "T1BAF30956F8819F11D5D111BAFE1E128E73131B7CE2DF72029D24AB347B8A8BB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696242, "uuid": "c7105c5a-54d8-442c-9b3b-5093023a8ebc", "value": "3072:ewhhSbIMJIrXWYeRnaB2MNmhUFVzAIUaIneQT:ewWbIMiX1eNaoIfFVzwaIneQT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764696242, "uuid": "54dcd5b3-2157-4fa0-9e39-4b9cb118ab23", "value": 158364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764696242, "uuid": "47b90146-dbf5-49ef-bafe-a224077ee2cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696242, "uuid": "dcfbec16-54a1-429f-9df3-8437d0250128", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b4b5124-cf68-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764670729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764670729, "uuid": "e8aa24a4-0c69-4a48-8da8-0ae9be54ee9e", "comment": "Malware payload", "value": "3a87cdb72a323f37403b518e65be727c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764670729, "uuid": "d9ac4f29-3c84-4c22-9a07-86b13deb35f8", "comment": "Malware payload", "value": "aaa6e29aded9aec6d42d3d92cc07da37a2dc992a9f62b6e164f68982b426566d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764670729, "uuid": "9c1a7cee-840f-485a-a3c7-295d96302d67", "comment": "Malware payload", "value": "bf08dbbc63dfe6334892a0665b187bb0846a6ad7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764670729, "uuid": "bd11587c-bf19-40d2-a0cb-4242d45cdccf", "comment": "Malware payload", "value": "4583cc271663d4fec71db0dce87a27ff3c9293b51c7b0de0f46312a2f3983015b0b14d2e5be3afe682d71d9cae8ea903", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764670729, "uuid": "761b337a-8e27-40d7-adbe-5fa0151937a6", "value": "T16A973349237521E3E6EB6A7A6177E32A82A07C581F41C58FD66C43271D131EBB13CE72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764670729, "uuid": "262817b3-b2e7-4082-87c6-f94d894c8634", "value": "c990338f8145dc29c6f38fb73cf05c77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764670729, "uuid": "f6391945-78c3-473d-9cf3-0b47af72b4c3", "value": "786432:a3oTYWSOOaKCjhEoYWJqHXMb8qhPA5H6LerRQ766/TC4cddjc9NouC5DbUWVkD8O:aYzSMK6pYgqHcFhPyvwmdoHwvUWi8de", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764670729, "uuid": "b769a611-bb5f-40ea-aed4-ad5f9f65fe2e", "value": 41971910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764670729, "uuid": "e2e66b88-da55-41d8-a7b5-a9ede78b7278", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764670729, "uuid": "bba417cf-1801-4d7d-b7f3-867c9bc22abb", "value": "porsche.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4db6bb68-cf59-11f0-a129-42010a9c0007", "comment": "Malware payload (Kimsuky)", "timestamp": 1764664291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764664291, "uuid": "434d3f31-6682-4430-9e75-73cf816b8b3c", "comment": "Malware payload (Kimsuky)", "value": "59c4b2e0c8e3ece9b5bb3a13d3854670", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764664291, "uuid": "7e461810-9561-4b52-a893-b1ea400c5034", "comment": "Malware payload (Kimsuky)", "value": "ab7b9da0f77a03ea2549b255a90cecff0e25413e3f03b132b14a87181d7baa3d", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764664291, "uuid": "50422d68-d5c6-4b03-9541-5dbb7ae51d32", "comment": "Malware payload (Kimsuky)", "value": "a2cb8eb20267f992b90289007f40b10175c3adeb", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764664291, "uuid": "4c8aaf27-57d9-4cad-9564-0ace6d530e22", "comment": "Malware payload (Kimsuky)", "value": "a3198593228fa369710a85e88fb1c6282fcfb5e78ef3494dafadda65fb80e35cb811957bbc53bc8fb679e1368882c6ca", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764664291, "uuid": "87186f51-c9f7-435f-9feb-561890c46f7e", "value": "T1FCC3129815B78D82F5F95C8EE289CCAC0DBC35785EA1F3A46D01094CF7ADA931252B3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764664291, "uuid": "b1f493a0-00a5-4e82-9129-d32de2bf2b38", "value": "1536:rfnLkuMzbAYATbzs8t10GEWdsm5Fby2s3VTAPcHlyXDIUY6IlOPzVIwOmdoP2eY+:R/jHUmHbb6APcF1qIY7VvWUQsoBumDP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764664291, "uuid": "039d3f6e-441b-4c19-a1dd-b60c721bf354", "value": 121387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764664291, "uuid": "ab171e79-766c-4a60-a6cd-f73d10aa653c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764664291, "uuid": "caf49efd-c6f8-4a7a-9f14-ce0b8d005481", "value": "59c4b2e0c8e3ece9b5bb3a13d3854670.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0432c032-cf94-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764689508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689508, "uuid": "cc0b088d-daab-4e06-8de1-9cd4a43d8c40", "comment": "Malware payload (Mirai)", "value": "3433fcb9a15d8d456ab2b7415512f3d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689508, "uuid": "8f5c3fed-9f7c-43d0-b949-370417087b86", "comment": "Malware payload (Mirai)", "value": "aceaeffc6a3960bb84ec59ad8dfaa6a1f4bb6c7fba96c651c8cadd0a949dfc09", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689508, "uuid": "fa29a1d2-b08c-4b5a-9a20-cdb9187dbaaf", "comment": "Malware payload (Mirai)", "value": "250aa64a24bc80b5ae448694330d9aee5958ce96", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689508, "uuid": "c3ef431d-1286-4df8-b205-ff075d6f4de9", "comment": "Malware payload (Mirai)", "value": "a1747f09e5dcab8897a866c9ad9ba1557fa194fbe72883fb97b8593926b5aac0750259297520f609dbb78cd01a28916b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689508, "uuid": "9e15c467-638d-459a-a1e8-bfa666774b1f", "value": "T1A5830251FB2351ABE833D33C5AAC93C06EE242BB4E0B84CCB65DD10FAC869606D431C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689508, "uuid": "fc1f4a7e-54a1-4e65-8990-ade5c67a0718", "value": "1536:GIhD24BWnRwHvU7/VuAaj8WCiN+z+P+vJwsikOC3TsM+A+MN13zaVJuV:GmD24KAU7/s1Vt+z+yJwmOMTsM+9MNBr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764689508, "uuid": "1697a200-5816-42bc-b4dc-2095d8154593", "value": 86460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764689508, "uuid": "36b999a5-e4f4-4354-bf55-aa7308307374", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689508, "uuid": "963ba589-6012-43d1-9319-435c23ec345e", "value": "ecco.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e991bcd-cf90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764687995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764687995, "uuid": "736f01a2-4044-43f9-837f-bfb303cd91c9", "comment": "Malware payload (Mirai)", "value": "8fc7b88d53fd35d4e19a11c88a6a7922", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764687995, "uuid": "0ea8e23a-3477-4541-98a3-a3c668214fbe", "comment": "Malware payload (Mirai)", "value": "adc3c7389f91aecee41943e1632c1ffd4b688c1164150556b58a3deed2a6d4b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764687995, "uuid": "56460ebc-2778-4f7b-810f-3932aea5ba78", "comment": "Malware payload (Mirai)", "value": "d72d983646cd342e27bc8559d5cd164573fcf007", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764687995, "uuid": "0ea0bdf2-b0b2-4a03-950a-2beba2a83645", "comment": "Malware payload (Mirai)", "value": "33b304054de4239031bfb42ff388ed367f9c20d7b13fcb4fbb12864c1ca4d442829d2725d2a8c5bc3e39556f0ba64235", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764687995, "uuid": "dfa61068-4205-4c50-9236-6abeb84da3ef", "value": "T10EB3C4AAF1470262C49305F026CFAF9A3D2313C16F96E4D33EB516B568B61CB6905FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764687995, "uuid": "51379e9e-5923-4f83-8117-b8e7a59c87b5", "value": "1536:zhRVsJmId0q9w2f4k7ykl0ik16gUh/LWd:zBmSmt48l0ik16gUhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764687995, "uuid": "d0a2d1e0-8e91-4c7b-990d-39e6baad5d2c", "value": 115992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764687995, "uuid": "a72e922a-4442-41b6-991a-ce06ce357075", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764687995, "uuid": "a2437e8a-6745-46d2-b7db-547846dab834", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20a13c10-cf94-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764689555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689555, "uuid": "bf7e5bf5-faf5-415b-8c20-7a5a1b413269", "comment": "Malware payload (Mirai)", "value": "daae3ba1de349e36bc6bf8eb392f764c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689555, "uuid": "560dab81-7236-4ddc-b777-f908450ad643", "comment": "Malware payload (Mirai)", "value": "afd2d79a8d94939fb9f88a19e58b63b2e653f1ccba499cff89b10b9ed0ca03c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689555, "uuid": "d3cfbe6d-2ef8-4c84-a155-1fa02f231722", "comment": "Malware payload (Mirai)", "value": "cbf8cb2d2bee62d5c7f54c9ca16bfc63835ea70a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689555, "uuid": "eb19f826-e9b8-4527-9ee6-f6fd135c5143", "comment": "Malware payload (Mirai)", "value": "20b1614bff79dc8127945129c2312f46166de79148fd07b287ed46de0f5aa57b2578fb4cbec391cf8d64b53d37f51017", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689555, "uuid": "9d06c9f0-ed4c-43ab-85d8-7affd0911069", "value": "T12764E80E6E228F7EF7A8877047B78D20976923D623E1D584D1ACD5111E6025EB42FFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689555, "uuid": "870259c1-e1b7-4845-b848-4a9b12417f37", "value": "6144:Vi3ubT7epMy+P4JTcY+uh/7Oj3dZRUftFlEFbG2vaA7Pp:VMpB7OjGlo5p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764689555, "uuid": "a75d2a1d-79c0-4900-8edf-57c85fca4900", "value": 312092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764689555, "uuid": "14215388-bc56-4c4d-a9c1-66820c0482c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689555, "uuid": "4b15919d-81da-4fe3-914e-617850cb54a6", "value": "ecco.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40a81538-cf50-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764660403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764660403, "uuid": "25e845a0-a4f4-4cde-8898-84e590691669", "comment": "Malware payload", "value": "d3d0c43aa000630ccda8b6d8251e19a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764660403, "uuid": "59c863bb-cafe-4130-b065-c21eb4aaa0e0", "comment": "Malware payload", "value": "b10c25ad1676342cba1a88b01c8b1cbd098466ecd4ee9e2a953b5b837deedbe8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764660403, "uuid": "9247ee6f-2d71-4289-b2f9-779c19872c9b", "comment": "Malware payload", "value": "8d746ed9f7cde63a4715a5c8d9c90969aefd3554", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764660403, "uuid": "ef1387f7-0c99-4828-8d4f-0ec8ae8ecefb", "comment": "Malware payload", "value": "9ebad9233bf77b510c35a9ea6f235504c483ca53d051e74aaa8fba07fc430c751231bb1460295cc8131b2cbc6a21b3ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764660403, "uuid": "1d8872aa-a627-42e1-a9f7-4c2da5e0e926", "value": "T158463A07FC9945E9C0AED2348A729252BA717C491B3127D73B60F7382F76BD0AA79740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764660403, "uuid": "64d3c77a-a9d7-4846-ac10-adfaf5f011c3", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764660403, "uuid": "612063bb-c1fb-4583-bfdb-47ff02abb89c", "value": "49152:3zH47bwWOYCWkJ6JrC/7hQNXZWpkmNPXnVeLXgtjI5EVr6CTXj3TaOJ+P1:jocW0GC/7hVkEtwpEpzDaD9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764660403, "uuid": "62fdcfea-b6d4-4ec7-9d09-2e053e8e91f8", "value": 5405696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764660403, "uuid": "abaa53cf-b439-48e9-97b3-fc59b0374742", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764660403, "uuid": "58d3dcd4-0dc0-4024-8250-bb8f2eaa0b80", "value": "agent.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57334011-cfb5-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1764703820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764703820, "uuid": "5b12acf8-b876-4194-95d7-8ef3cf954163", "comment": "Malware payload (AgentTesla)", "value": "18ac71f73790482af6c5b850ea6bb6af", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764703820, "uuid": "1ad7c222-1e5f-4ab3-86bc-d0616d395a0e", "comment": "Malware payload (AgentTesla)", "value": "b18df9a29ff8eb9aa2080eb63e36e512e9217ca33dd18582d85138befa7050ba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764703820, "uuid": "d1f4d9cc-5474-4fff-8c75-a285b3bb02ff", "comment": "Malware payload (AgentTesla)", "value": "9876483964bffbcf3282a9683f73203cd297b3b7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764703820, "uuid": "84fa9b55-7acd-4fee-8b43-f35a96967a7a", "comment": "Malware payload (AgentTesla)", "value": "52e51f044d0df2ac5decaf0aef80cc1a839e970ff7500970bad1d40aedbd652fe4b2ee4b8b2eb00dd8c8cfd99cf27ec6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764703820, "uuid": "b1da1397-6af7-46aa-a894-c3365647950a", "value": "T1F0C423E41F4827229A424CF3D19678132F1678621B611B3BB2DBC4F8F0B7539BDD9A94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764703820, "uuid": "dd4fc0b5-3cfa-4943-a7f8-cdb52cc860f8", "value": "12288:iBCCj1NAkUBn3gcC64pU7OK2tCcqoXfOJ5ahjWgYnY9w6+9r:GvCBnwcR7uCcPXfOJnnYG1r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764703820, "uuid": "c4976942-96a0-4d8e-a26a-529ea498fa27", "value": 557709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764703820, "uuid": "6cce358b-2203-4c9f-b3b5-3e1513fc861e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764703820, "uuid": "a9d46d59-e503-42ec-a0b2-6ce316efd3f2", "value": "nPO___0312025TOYOBO3.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f634311-cf5b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764665260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665260, "uuid": "9e285e02-e1a1-454d-aac7-7ce965f49ab5", "comment": "Malware payload", "value": "de7dd646b946b6533c5d3139047afe6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665260, "uuid": "94ff8463-e42e-46a3-865b-c2edf0f66a56", "comment": "Malware payload", "value": "b2b573bb2249e8aa4a7799af694d0b56ec6748602476bf09061a2dea038303cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665260, "uuid": "0cdf0806-74c1-4108-8250-386fb1ce542a", "comment": "Malware payload", "value": "58619ef02bb339fc1436a74925feaeb2b9bb333c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665260, "uuid": "fee7c2ce-55d4-4b23-a393-e2c25b2d034e", "comment": "Malware payload", "value": "07ec3dd1a5829f592739d5867a9cf5095f1a8c6fa1a94442fdccd81239983e8948097d62b890be236f2c79493682b788", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665260, "uuid": "e8b9dc23-bb42-406d-9575-1e79011a8c7f", "value": "T1D0461204F7A5061DF466FAF62D21711146B3BE479815C649E3B33088EA76E43CE6C2EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665260, "uuid": "800e9625-9495-4fed-9ba3-499c057fc002", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665260, "uuid": "7bc9d233-3ff4-40de-aa07-8996b738896d", "value": "98304:8h/evJLeTmDDi9UeK7kqXf0FGxLCbD3ha5Uc6v6O3xUM3/L9LI/cbt7/Cp/z2OIn:8h/ev5eTeW90kSIbDoUcfOhzT9cEt720", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764665260, "uuid": "8432b8c4-6e53-445a-b36c-f1271347c679", "value": 5858856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764665260, "uuid": "1dcca5b5-1514-4ffc-9022-a19e61e059aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665260, "uuid": "d7d4f9d2-0081-4e16-88e5-07ab9861b851", "value": "exodus.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7db4924-cf9c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764693326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764693326, "uuid": "85d6a1c2-87b1-4308-a6f0-fa9cc9149f6b", "comment": "Malware payload (Mirai)", "value": "70bf4602a1d1c73a507a2fcdb3d562d3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764693326, "uuid": "baa4f185-f2d7-4f86-a3f8-5775aed8ae08", "comment": "Malware payload (Mirai)", "value": "b33f6651443ac30e314256c0c211a536bcadeee5db73148c9d2abe36b39b34d0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764693326, "uuid": "9ce921a0-4de0-4706-8b16-ed5360eb49d3", "comment": "Malware payload (Mirai)", "value": "c0862878494a0c8ea6186bbc4bb05e225cdb2b78", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764693326, "uuid": "45b538dd-a88d-44dc-a5c5-d7b08f6becda", "comment": "Malware payload (Mirai)", "value": "d57a86cf9e2141b11ca0a04ba15dbd0017e3a082a48245bf8a332674d2b5a88a7b185ac4450a6fedd432f175dfe12b8d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764693326, "uuid": "c672cbc2-02cd-4289-97d9-be9370ab037d", "value": "T1FF519FCAB3D69A70EFB15D9A75F5840474C0E09967C3CF86E0FCA4BD0A4EF095490BA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764693326, "uuid": "c72d3a90-fd90-4c8f-8015-b8fb1ef42d32", "value": "48:vXUo+UoYUoOUo0UoUpzEUo7UogUoVUoSUoKUoYqUfUoLUo+UL:vXt+tYtOt0t0Et7tgtVtStKtYqUftLtH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764693326, "uuid": "e97f0f31-0227-4f28-9ef6-47f3e745c545", "value": 2835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764693326, "uuid": "a6ac0fb7-b1ef-4da7-bbcc-52661f67f11a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764693326, "uuid": "5fda2585-93df-4957-b40e-3f4ce4273352", "value": "zyxel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "521a5740-cf61-11f0-a129-42010a9c0007", "comment": "Malware payload (a310Logger)", "timestamp": 1764667734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764667734, "uuid": "e147070b-2e42-49e8-b92b-1d4976defe5d", "comment": "Malware payload (a310Logger)", "value": "9a5d64c833c68997f03aeaf8730aa6f5", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764667734, "uuid": "95308543-f9a8-49c4-8ae7-dabfa063e2d2", "comment": "Malware payload (a310Logger)", "value": "b37ce724d85e34d6540c65601032cbc9cc1149e09f219b4a7364ed12c8529803", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764667734, "uuid": "0b7ad34f-c909-4a88-afde-f522474cc8bd", "comment": "Malware payload (a310Logger)", "value": "2bd883b956690719579b19aa7624532831cb79e0", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764667734, "uuid": "ea5545bc-5197-4527-89ee-da1b7a8b7d1c", "comment": "Malware payload (a310Logger)", "value": "49cb02ac35f8ddc47b144f709863c2ab1058abd7bd8d9bbf0068728ccaaa31bcf38c712db71f65da39034a5c7d791812", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764667734, "uuid": "fc323e58-a188-4ca5-9706-f8f1ee0603db", "value": "T10EE423CF7BDE11F80BE3AD4D38BB7CCB9D416316B97560668A1C0699EAC4D339304096", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764667734, "uuid": "8a4704b3-27b7-4354-a799-e20f993b3f96", "value": "12288:lxVnm4rPK9ivPuUW8FsBiJdK3E2FLufaAWkFKE7WuP6NWna1yt2m:r5QeD58kaAWDuPOowyJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764667734, "uuid": "3ed0cda3-3b55-4d37-8b21-e094fb3242e3", "value": 665961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764667734, "uuid": "06ee1bed-b806-45f9-b3e9-38ecbaccf422", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764667734, "uuid": "90132f36-95fb-4545-911c-4b957aaf210a", "value": "Purchase File _DocumentFOBCIF_DUBIA.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b91d3d3c-cfa5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764697113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764697113, "uuid": "e91089d9-d6c3-4cf6-81aa-6b7d5a9edd75", "comment": "Malware payload", "value": "5cf4379e2b0991e4610b5d8398c6ad66", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764697113, "uuid": "515b85c9-4429-4aa3-ae12-446555416cf9", "comment": "Malware payload", "value": "b45f7dec108a907638ad3cfe3eb42dd30586e23ee57fe2b2ecd408e397f9be05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764697113, "uuid": "c8ac7798-2963-45f9-aeac-e9b3b3b8b622", "comment": "Malware payload", "value": "4565a534d64308f4a500672416e61564ad4cb068", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764697113, "uuid": "94b27ddc-495d-4f81-b9c4-7e143fcbfd01", "comment": "Malware payload", "value": "1eb8d1480fd5af72d31b27fe5f53d3091246a7d90d6f2f2c153a10d07563e03e47734843f6b07fc8c0ddc70fc4ff17b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764697113, "uuid": "341b8670-3682-40a5-8812-62257b0979e8", "value": "T1E9B30756FC81AB06D5D522BAFE1E118D331327B8E3EE7112DD245F2137CAA1B0B7A512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764697113, "uuid": "6cd68993-6e85-47b4-ab3f-7df4f33233b3", "value": "3072:kB/JWflttn7aHjLukvsWgah/XaUQYbi17TPSBg:kB/oflttn7aDLzvdgah/XaUQ6i9h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764697113, "uuid": "bc6314d5-4750-4f1f-b1cc-b48465909fbd", "value": 116356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764697113, "uuid": "47ddc96e-fd0d-4cb8-9389-1d22bae713ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764697113, "uuid": "10c7c87f-db0d-4ee5-b112-e1ce901ba3b8", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a88ab78-cf58-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764663963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764663963, "uuid": "33ec35f7-2961-4bb2-a70c-7ffebcb8be2f", "comment": "Malware payload", "value": "419e5600e1c7952ea826d5417171960a", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764663963, "uuid": "278f4d47-8b12-4549-aaf0-078b12187060", "comment": "Malware payload", "value": "b4b2197c5a8f0e9b9766fa39e9b538568284ec8a0099811b8b54fe6a1402545b", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764663963, "uuid": "58abe0d4-2d93-4122-bc55-3d85e24ab746", "comment": "Malware payload", "value": "30ca32977cacf2b62dcdbed7a06831c1938fc31d", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764663963, "uuid": "21b5295b-e13d-45fa-9096-af3232196531", "comment": "Malware payload", "value": "8fcf837ed9f59dfd81759ada460f67d7cd4bb3c72f0093a63a5e437b1e12fec554b87d422da08ba34d06e46c90969f14", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764663963, "uuid": "2c2e6401-8124-445c-a7d8-3cccc58aa5c5", "value": "T19C761203F78E492ECDE2B978499713716A15ACEC1910828F4D02F218BEB76D95F26FC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764663963, "uuid": "89e40237-7d21-48b6-ab30-f7873df9e3ae", "value": "196608:whNWnAzRU5BQ13O3eFgBij+7qvMFhVexR:whNMuSQa7kMFSxR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764663963, "uuid": "3613fde9-5d02-464b-9589-afde9f8a71e9", "value": 7525641, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764663963, "uuid": "5e469213-ebe9-4c47-8294-107fcba86790", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764663963, "uuid": "5d3c7cf4-f5f8-4c3b-ab67-cf29c99d58c8", "value": "TikTok18.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74c83b38-cf5b-11f0-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1764665215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665215, "uuid": "abff3aeb-8fe8-40e5-8e67-de83fa632d9b", "comment": "Malware payload (SnakeKeylogger)", "value": "2736e27f8add019ea79d192b1beb4c6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665215, "uuid": "a1af943e-4a89-40b3-b7a5-9a938b7c2326", "comment": "Malware payload (SnakeKeylogger)", "value": "b4e1932f23a54390bc8743dfa8a7eea4c3e446eae0c97625d780988688274bf3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665215, "uuid": "24191735-9818-4ed7-99e0-a263f919b5a8", "comment": "Malware payload (SnakeKeylogger)", "value": "c34ece30a2bb888ef8b14988997ec057030c13a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665215, "uuid": "6717950e-11c2-4d50-bca0-0af28ba6401a", "comment": "Malware payload (SnakeKeylogger)", "value": "1e48c90ec84ae7c6a2dae631278d0225cbea58315ae2c52d1e11f2845b699ea63a37b07af8765f3cd378d50d802f7f7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665215, "uuid": "6bc4b500-dfc5-4f48-a3e3-5a05dfb516df", "value": "T1F1D4F1135968CB03F52497F12E73EA355BB23F5DA522D29E4DEB9CCBB910B014C88627", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665215, "uuid": "13928160-89b6-4e2a-9415-932d1619b6b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665215, "uuid": "a4f5aeaf-8d20-4636-bc96-3094109e5ecf", "value": "12288:Cbam5R9xHCakKLu45tmIg2rR7viKjv5sleCnCpthYvgSkR:Ua+DCj94XFrRJv5GCDXh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764665215, "uuid": "8abfa72d-2d6a-4a4b-84e6-2dfe3f1143b0", "value": 629768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764665215, "uuid": "fdd92acb-53ef-43a9-8ab3-33bcd1a60fd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665215, "uuid": "a486ad15-1a5e-404a-af51-ec69194a1f55", "value": "BANK CONFIRMATION RECEIPT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aae1215-cf9a-11f0-a129-42010a9c0007", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1764692095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764692095, "uuid": "38ef2c3a-cd61-4204-8405-7c940f9fbd58", "comment": "Malware payload (Socks5Systemz)", "value": "56cdcf3585bc8646cede7b7c33726b71", "object_relation": "md5", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764692095, "uuid": "e91f496c-0e9f-4ea5-9a2e-901ea8975d28", "comment": "Malware payload (Socks5Systemz)", "value": "b525c5c44f0a256af3630e14643dc53dfc14086e38c1f903d29c435776e9c2a3", "object_relation": "sha256", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764692095, "uuid": "0a6d23e7-aaf0-48a4-b52e-23e51c7930f4", "comment": "Malware payload (Socks5Systemz)", "value": "70de74c0aa9d2a6cab76a5ce722ffb580f6dbf25", "object_relation": "sha1", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764692095, "uuid": "37d81a0f-0720-47d4-8ce0-70d68d6d76c0", "comment": "Malware payload (Socks5Systemz)", "value": "69f8d3b8eed7b81c31d49893d820dcf80c6b2ebec7ce9e38348971b98adaf96ae16d5d0b6400c5cb83e68ff0e1d053dd", "object_relation": "sha3-384", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764692095, "uuid": "6e4da826-e074-4ea3-a569-164b23bfe2a9", "value": "T1B6E533D70747537CC865283A8A7EB6936E35BA522D3B000B67CC5F1D463C094E6C6BAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764692095, "uuid": "83c46446-b465-4cc0-aa51-64caaf0e3b06", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764692095, "uuid": "84c6a074-dfa1-41bf-a5b1-7ed472898b66", "value": "98304:MQcabR+Fe3qHeA/fTLnCr/qAwcs/LP/u1EaWmuB:Xcab0Ue/vCrp3q/u6Nb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764692095, "uuid": "6e50896e-8c0f-44c0-86ee-73bba83f3400", "value": 3295990, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764692095, "uuid": "6a5769f0-90f8-442f-8c9b-86f857e0766a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764692095, "uuid": "03e5e85b-ffe5-4ed0-9e53-8750710455cd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6edf098-cfa3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764696250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696250, "uuid": "3494baa5-b9e7-4909-bf71-372087633089", "comment": "Malware payload (Mirai)", "value": "0309c65c13b273853c85b1da70515300", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696250, "uuid": "e668b99e-5fc3-4bae-a8a0-a1094efcc980", "comment": "Malware payload (Mirai)", "value": "b6276b1e1b3a25f05edb6fafc89678f42d2d38964394d7fcc4d4ec2fa4439ffa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696250, "uuid": "727d4a06-dccb-478b-a82d-fb0f3e3d78c5", "comment": "Malware payload (Mirai)", "value": "4b078bdd2c8be88e25bcda30e291baede585eed2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696250, "uuid": "905816f0-b58a-4614-b57d-df4d58ac8383", "comment": "Malware payload (Mirai)", "value": "e771bc3c7900236b3e2c4959e5f8c1defc55c6cb0129d701ed73aaa64ffcf529f8ddb3faba11fcc972636125049edad2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696250, "uuid": "7e039c52-acce-4bf4-83b7-bed96f8e205e", "value": "T16E936BC5FB83D4F2E84705B15037A7338732E93A5039EA46D369E936EC52911DA2B36C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696250, "uuid": "bb8b0f43-8d87-4c4d-a9b7-2ece679f2a60", "value": "1536:1xFnqj8/TCxYFHPlAGg8TF5fL+cSA2dsn7eiFySvm4UnVp6:vMj8e6Fhg8fLvSA6sCObTUVp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764696250, "uuid": "8ce5d950-2492-4c17-b12e-175d7b60cd2a", "value": 96428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764696250, "uuid": "2aa4b7b3-5115-4391-b8e8-80e7d4339bb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696250, "uuid": "fc5abdda-9ef0-4e8e-b6a7-370c088505f3", "value": "nshkx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ee41053-cf36-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764649260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764649260, "uuid": "4b56d614-6701-42d0-89ca-51f8f934922b", "comment": "Malware payload", "value": "de95140a06971166f6e582d418c8f934", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764649260, "uuid": "e0bc9760-d8ed-44b5-979d-190ba68c5a25", "comment": "Malware payload", "value": "b6e0d3f7ff5f6c0d071f2e7f9419a2f925e49b00e5a58d638a9c484c647f9931", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764649260, "uuid": "8ebcc11d-b366-464a-a167-c5f57e34685b", "comment": "Malware payload", "value": "bb3ba169c1cbd2a8aa6f57911655e3a3a4ce9ec0", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764649260, "uuid": "cbf29a85-0f36-4c27-aa19-04775b04efb5", "comment": "Malware payload", "value": "3c0c23e711994dd5568bb628b6ee226092a70464d35a62aa808d13560b563caed4f0f21e4582f6724b04b4d03b51ea03", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764649260, "uuid": "1e3538a1-b7c9-40d8-b230-37b9c87790c4", "value": "T16E7375590FDB84E8B627B4548AFF8C01E7E98513221CD6D5FF4DA9E02F11928E2F45E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764649260, "uuid": "0c7b540f-1e09-49b4-83a1-c6c8f1a2196e", "value": "768:mIwekVIwxmtW1JTkrdram+Yei34ZmPC/c+J7bg7iVbyztqw2UAM8+lMi6QXXPN5M:8CW/kfImPCk+8l+++LT/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764649260, "uuid": "37e0ecad-b661-4a27-ace4-2553cba60dd5", "value": 76956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764649260, "uuid": "7beea2f9-df63-4959-bf54-f8aeffb71575", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764649260, "uuid": "714f69fd-88ec-4f99-a21f-a33098da73ed", "value": "1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81e688d0-cf99-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764691866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764691866, "uuid": "8a22490f-8da9-4b08-bca8-6169b54e7ee1", "comment": "Malware payload (Mirai)", "value": "3af743e59d502e670cdf4663e81851ee", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764691866, "uuid": "c75337bc-bd7c-440c-827a-81ee7964d744", "comment": "Malware payload (Mirai)", "value": "b8208caa0044f5ad85dfbe803521baf2c6ae94a0b66673a088a5a23ccdd42697", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764691866, "uuid": "f287901c-99ac-498d-83bd-b9fe22c2560d", "comment": "Malware payload (Mirai)", "value": "5c7db6dbf4dd6ea9c55481e66bbce8de1e3bf6cb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764691866, "uuid": "12e7d660-de02-40a7-a6bf-9790b9c3b728", "comment": "Malware payload (Mirai)", "value": "8d8a743cc136d9d71ed1634d22f6be4ca71b01a838cb9ea53d76cac91b2d8f1e72093db074066f601b663a86e5d080cc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764691866, "uuid": "3e4a36c0-6030-43d0-ab4b-9b803c9b1a56", "value": "T13B517FC6B3D64A34EFB15D9B75F540147480E0966BC3CE87E0FCA4BC098EF099490AA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764691866, "uuid": "b4747d21-8ac0-48a3-b250-93afcf9679d6", "value": "48:vXo+oYoOo0oUpzEo7ogoVoSoKoYqUfoLo+L:vXo+oYoOo0o0Eo7ogoVoSoKoYqUfoLoq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764691866, "uuid": "18a607dc-5962-4e4a-bfc1-e24ed847e3df", "value": 2863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764691866, "uuid": "a76a9d80-f93a-4512-a73b-13cd5fd39a0b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764691866, "uuid": "089c8089-5fae-4e23-b16e-c41551a69760", "value": "goahead", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8132753b-cf99-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764691865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764691865, "uuid": "e894ff6d-f62a-4e1f-89ee-a1dacd11d942", "comment": "Malware payload (Mirai)", "value": "b3feef0d0215aeebc7b7a43e35b03343", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764691865, "uuid": "bbf8a279-9755-43d0-acff-3d212f185cb5", "comment": "Malware payload (Mirai)", "value": "b860f42051010197b9e837bfd609a2d58a3c1602a078a8ae16e1a295cf2bddd1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764691865, "uuid": "95ae294d-3ec0-42e5-bec5-53a62fe32f5b", "comment": "Malware payload (Mirai)", "value": "c231f18f5eb79a09ef14a37faba639546503b536", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764691865, "uuid": "eb5ef923-395f-46cc-9c40-610ef6d5b60f", "comment": "Malware payload (Mirai)", "value": "30e1584a41117cca38863438e4876954b914754cd018c2e86bce34ae904f5f9bc4224ce86adfc8291c747a4eaccf2789", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764691865, "uuid": "b215004e-020b-4a74-8320-da4eb8990ef9", "value": "T15673026445F64454E4D3C27189FBF4CC002F9A3D8A697B720EA401DFE696BA63BC93E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764691865, "uuid": "4cb90cfa-b46f-488c-89fd-5e51c4bf63ba", "value": "1536:YHcLa/0kKAwmegcHbNo+XSAkKmSp+N9BGsEisTMXjUDRnlrUnouy8GyH:g1sNTj97NxXSAzppweDTco1lrkout7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764691865, "uuid": "3143d728-4a95-4f37-a14f-5d33be598ee2", "value": 79668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764691865, "uuid": "43abe6a2-c658-429a-ade5-317dd70ebd81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764691865, "uuid": "186c0bf8-99cb-47d7-8e33-226381591ca3", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90ea5197-cf61-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764667839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764667839, "uuid": "99c583e7-b52a-48a8-bd53-ff6e6ef8f4d5", "comment": "Malware payload", "value": "ef776e404e39e89ee326af4252bc8a61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764667839, "uuid": "4456a01f-80df-44c1-ad4c-53279aed7fdf", "comment": "Malware payload", "value": "b941c271b016f482137022b3da58e5aae4c989f37d351497e6f9a967dd6bfd20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764667839, "uuid": "f8c4993b-df66-46b1-a671-7c4e6429bbfa", "comment": "Malware payload", "value": "fbd24c0be7c9fdb0b9d32b66ff2f51d44d18f833", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764667839, "uuid": "08fc7e5c-f6c5-43b8-ac3b-74861c358ade", "comment": "Malware payload", "value": "2da1bec737b540c791f6f44b979073f20b4cb2f5160fb7c8fe2b03869bd589aa78c825888bd3349ca7af5a0a2fb85c6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764667839, "uuid": "502f5007-2896-4804-848e-0e913c8fd23c", "value": "T14A135B279E2C4E73E69F497C98A663162EB98313A2D2F34E5D88819D19773C07A053D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764667839, "uuid": "e0ab5101-2ea4-4a4e-bedc-fcb75b295a60", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764667839, "uuid": "e8465b78-d101-4d11-ba75-92cf3ef24706", "value": "768:Y1QAtx+fEzswrJcrP7+6nZSm5E7ElgP8ea3jUq/mfG7hqpRxb82ADB1XgNF1oR:Y1d8AswrJcrP7jV1qP8aq/mfGlq/xb8X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764667839, "uuid": "911dd212-71d5-4a73-9557-f3fe228412c7", "value": 44560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764667839, "uuid": "c01315e2-d27f-4ec6-b9eb-ce66b3ef3904", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764667839, "uuid": "f5fd10b4-7bbe-4a57-9559-165cab67d587", "value": "Picture202512016898u.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a398d87f-cfa3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764696217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696217, "uuid": "f9fbf2c1-ab0e-4516-823c-d192a048327b", "comment": "Malware payload (Mirai)", "value": "1d55c6c8996fdd09b71586048bde8f4a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696217, "uuid": "25cff3d4-29f8-4069-87cc-f964b870037b", "comment": "Malware payload (Mirai)", "value": "bacf8e05ad6f4717a7a60253ac2d45c2d09ecab05315f4a090ebfa2544fd89ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696217, "uuid": "ed12093c-17b5-4d91-96c5-959a72f178da", "comment": "Malware payload (Mirai)", "value": "9223292b92688d7dd93e9b4a360e7eaedc78c399", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696217, "uuid": "53bf8952-257b-4b6a-a9af-fcb30d791d72", "comment": "Malware payload (Mirai)", "value": "7bf14d5d7c3f063cbcaecfaa6b7abd8584c0177448ae455434fa18971ee6237b3b15589cfe8613c08338f188b107041c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696217, "uuid": "8f6af379-abb0-4819-b4d2-0be30f504d1f", "value": "T16FE30945F8819B11D5D112BAFE1E128E33131B7CE2DE72029D24AF347B8A9BB0E3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696217, "uuid": "ce0a7035-fd75-4949-8528-1f35b39fa4c4", "value": "3072:gXRDuC9D76QX7ax4+adWhwAyGYX8NN6yS4Qp:gXwC9DdX2xTavcYX8yyS4Qp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764696217, "uuid": "3ba96dc6-9f04-46d9-87b4-5267d76f22dd", "value": 154332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764696217, "uuid": "b2a9b701-2f38-48ff-9c2a-959179509446", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696217, "uuid": "cfd48a16-504b-4a64-bf9e-1f3eee282e04", "value": "nsharm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b08c070a-cf81-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764681636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764681636, "uuid": "accd48c2-23d4-44da-9246-c6a125889e69", "comment": "Malware payload", "value": "5a5ae1f6682f51e92ae6b5f5ce85d8b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764681636, "uuid": "ca5e29d9-eb62-4dff-b275-40de005a5c41", "comment": "Malware payload", "value": "baf9ccea66648e7954c07d65b78f260ef03b0a27108f72ad95f71b05e932b7e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764681636, "uuid": "c08faab8-2771-4df0-af85-8328dd2c071a", "comment": "Malware payload", "value": "eaf7c8d01e82550dc10033d55fc51513168fb9fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764681636, "uuid": "e72a1c72-d9d5-481c-92fd-87c3fecb17b1", "comment": "Malware payload", "value": "a562039101ea743ac279a7a81013d0f374b4091e1a2bdc33cfd6630a86db59c04e66fc26a7cac71c61538e3d905a53bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764681636, "uuid": "f0030881-2876-46a3-94c6-8a0e9d9d1fd8", "value": "T1AFE633527C88DBBFD4212770C6419B77529B7A74481018AB6F0C1CB66FB38CDE529B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764681636, "uuid": "80ccd27f-aef0-4139-9429-57316aa570bd", "value": "0c40996f6e1e5f2a82b51e9950881bf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764681636, "uuid": "06d946d2-e929-48d8-8541-c365dbb34494", "value": "393216:f+F/OiT86xvk7HiMPo7c7rd+ljUxrwn5UcmQMD15:6rRxvoC/7a0jUxX7h15", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764681636, "uuid": "568a96ed-a3c7-4172-8f9c-89ad1ae9914c", "value": 14782000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764681636, "uuid": "7b51cf45-8542-49ee-9591-c18216c86a05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764681636, "uuid": "ae1fa98f-2759-4d6c-beb8-e32b36591b36", "value": "Adobe_Reader_PT-BR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "720e1654-cfc9-11f0-a129-42010a9c0007", "comment": "Malware payload (CyberGate)", "timestamp": 1764712455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764712455, "uuid": "c90fa99d-267d-45ad-bb23-c237a3b207f6", "comment": "Malware payload (CyberGate)", "value": "5c583e6e1d38d654a378e68e0d843533", "object_relation": "md5", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764712455, "uuid": "cdc10283-f338-4612-a1cf-81b423a8a5e6", "comment": "Malware payload (CyberGate)", "value": "bb217671489213dfb4eefff0d0af47621615d9a0c85415c0e31f2cb08786d359", "object_relation": "sha256", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764712455, "uuid": "e115b6c0-bfd1-4d92-9866-d7667473fde7", "comment": "Malware payload (CyberGate)", "value": "df5132b1f211a60c0d85f5fcc9759742de3aa1bf", "object_relation": "sha1", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764712455, "uuid": "f5b10631-9aea-451a-a035-e69edd7ecf91", "comment": "Malware payload (CyberGate)", "value": "73cafc751d2f4777800cedee956329718bf20ecf2983cbb62d99821d757d7925cb494155f215c3ee7ce3896c810e0185", "object_relation": "sha3-384", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764712455, "uuid": "eaf0f8b8-e0bf-4007-97a9-8effd0819ad4", "value": "T1233633DD8F22335BE8AF5AF084AEBF61250D1537D73A2C76070E4269EC1245C57ABC68", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764712455, "uuid": "af564fba-cac6-4903-be83-8313acf154e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764712455, "uuid": "cafafcf7-2975-43b0-87aa-72f42634df29", "value": "98304:Tk7Mw3YWD1Fne8FQ8753OMwEFHKqcFCz10gLE8Ah1lArSIJxDME1AbPk:Tk1oW7vH75VF0iHg1hSnps", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764712455, "uuid": "47b35d42-c868-43fa-8cc3-bf74b1837b38", "value": 5279744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764712455, "uuid": "26d5beb6-99ce-404f-92a0-073a940b96f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764712455, "uuid": "9f25d5ec-a42d-42c5-b963-f7c9ba444b1b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86c66756-cf6b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764672117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764672117, "uuid": "02babbd6-8c63-4d4b-a3f5-81abd8887ca7", "comment": "Malware payload (Mirai)", "value": "a8b625d579c0a987faac407e75031654", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764672117, "uuid": "c992374f-6956-4484-a94c-f0c2204ae99d", "comment": "Malware payload (Mirai)", "value": "bb7b1773ba7cec8ce424a9280e2780fff5d23f1f7e51f931e84cfca15018f54a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764672117, "uuid": "84c19d2e-1a7e-4925-afc3-20a99bd54af6", "comment": "Malware payload (Mirai)", "value": "35ac7694e1e81d3f8ce5d7e0709c99da2b855078", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764672117, "uuid": "68265dca-030e-4bb9-93db-9b5b3fe085de", "comment": "Malware payload (Mirai)", "value": "f5ebfd2b23b463dc3d9c8e9dd323d633c233c2e0a9153de54d2aa808c577071717ceb1363e580ded9cc46cda48f10e54", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764672117, "uuid": "8cdcbfeb-694e-4903-95d2-897c2a575896", "value": "T1AAF2F1357BBB7D15EBE00DBBE6BE854D95E54ABE50E93710A80D3271F9C1E2C40A808D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764672117, "uuid": "45639018-53af-4f73-9e6c-bb7d1adc28b2", "value": "768:41N729y1VthscOzXYGm66pp0ajViJCana+5is3UozU:i1VthDgXHp6pp0UE5xzU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764672117, "uuid": "0f732f71-c868-4918-ab1f-c0d42ad14efe", "value": 36204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764672117, "uuid": "5a2c21b2-7ad4-47fa-9620-450752d88ea9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764672117, "uuid": "2c5a4b19-c889-46e2-89bb-81f0c2932804", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22014a81-cf94-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764689558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689558, "uuid": "9995f9ee-673d-4262-b868-b2417c1cb92f", "comment": "Malware payload (Mirai)", "value": "09d710bd777a52eb28abb67de4cba7e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689558, "uuid": "8e581f74-f9b0-4c04-8989-0aa5d46719f8", "comment": "Malware payload (Mirai)", "value": "bbe3c8fa5a5d576828c2f9caf17d4e3e98d77e3870f01044b4afe180f49e2656", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689558, "uuid": "3f871885-add6-40ba-a74e-42e5e144e1e9", "comment": "Malware payload (Mirai)", "value": "9d72e0cbbe59b55cc284de3923cb45e7249d63a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689558, "uuid": "b921b633-f94c-4f41-b876-22d5013f3523", "comment": "Malware payload (Mirai)", "value": "c048d245c6b661de41a53ca3c6185f80dfe7a832f06dfbd5600f82dd9aa78c585a454b25b333dc585dd146b759d43b58", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689558, "uuid": "ba715e28-13ac-4cd0-9926-980b7ee7b08c", "value": "T191643B46E9418E23C4C62BBAF69F4246333397A4D3D772069A286FF437C775E0E22645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689558, "uuid": "ae0d65dc-1ec0-4115-9163-8be2a7f81c4c", "value": "6144:w6F9hvzmTCd8X9TgXye/X0sTkaadv94WH32trsifD+nmxDEM/RpO8m22ea0vmSka:rF9tzmTJX9MXy40sTkacv94WHGZs/qDZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764689558, "uuid": "fdef825b-78d0-4813-8854-10c2ad98219e", "value": 319504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764689558, "uuid": "f24b246b-c930-4600-813c-cf5694b2a6a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689558, "uuid": "b790dc9f-57b9-42b3-a333-7789503423a2", "value": "ecco.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06a7b24f-cf96-11f0-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1764690371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764690371, "uuid": "03298c17-eda4-47e5-9c51-4eeb703bc266", "comment": "Malware payload (Joker)", "value": "91e6740235d8cfd2821864d77aca784f", "object_relation": "md5", "Tag": [ { "name": "Bill Fraud", "colour": "#DB773F", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764690371, "uuid": "74bb3c10-60aa-45dc-b72c-c04b27e4fd16", "comment": "Malware payload (Joker)", "value": "bc178620b7f5516a1aa0560971292779cd6f8025d7ebb922dbaab4e115f67a96", "object_relation": "sha256", "Tag": [ { "name": "Bill Fraud", "colour": "#DB773F", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764690371, "uuid": "43385697-b9b6-4df0-a26d-c72790788f14", "comment": "Malware payload (Joker)", "value": "ee5a91221c983ec05af058960dc1e10229215a66", "object_relation": "sha1", "Tag": [ { "name": "Bill Fraud", "colour": "#DB773F", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764690371, "uuid": "ad6182ad-cb0e-4831-b20b-2bad2f2c170b", "comment": "Malware payload (Joker)", "value": "af9cfcd03d7daf28050817e5062044e7fc5e5ae4c1d17c4dc67fb657b9cdf94d1dfc16de1687b732f15d9430ca5e7201", "object_relation": "sha3-384", "Tag": [ { "name": "Bill Fraud", "colour": "#DB773F", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764690371, "uuid": "e18881f7-15c5-47fc-92a4-0edda884dad6", "value": "T14FE6238AFB0C941FC9FBB0B68E795261521FAD551283975B6C04B31D7AB72840F6AFC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764690371, "uuid": "979d5902-d731-4e35-a41e-e877a0b3bbf2", "value": "393216:e74rrfYzvhQhAoSyXNVX4X86ziwb1koEv9QGt:xQhgjdVIs6AoEv9pt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764690371, "uuid": "89d9db10-6a5b-46e0-84c1-002907f9ef11", "value": 14958109, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764690371, "uuid": "aa9e16e1-8527-4da4-924d-beafa2552048", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764690371, "uuid": "f4d6937a-ba04-4be4-9f64-92d4a30daaba", "value": "Junk+Files+Cleaner_1.003.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6f4e1a5-cfa3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764696223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696223, "uuid": "bc011e1f-f449-45d7-a664-9185041d83f7", "comment": "Malware payload (Mirai)", "value": "29a115da1dac7a48c64023019290c7ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696223, "uuid": "aef4857f-3ae7-48bb-bbc0-2adf34b6fc63", "comment": "Malware payload (Mirai)", "value": "bc4c8bd4b9412396573d8e01ecd13b3b34275277f865c59ca24025430f3659d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696223, "uuid": "b27d9968-e926-45df-897b-61e41959a7ac", "comment": "Malware payload (Mirai)", "value": "5c36e835a6ea1945f6efc14063454abdf009418e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696223, "uuid": "75ff40e2-e77f-416c-9e0a-6cc8f84e4e03", "comment": "Malware payload (Mirai)", "value": "958368b7678beb7c0c007176e23f45c2ba430ca0eb9476f1fd1077b0bd7a890fc4aab9f51efbb6c226457a3ebacfc8b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696223, "uuid": "87285fa1-9112-4ce5-8ff7-18d213ebaf48", "value": "T1AD04D71AAF620FBBDCAFDD3702E90B0535CC954722A43B7A3674D528F54A50B49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696223, "uuid": "b230d6dd-fb74-43c0-8135-edee3b851c5b", "value": "3072:Q6zkwdTZHbJqg5YZKSdwxUl5fisQIWtI4wp:Q6zk0TZHVP5uKSuUltUXI4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764696223, "uuid": "055f61bc-5743-4f6d-93aa-f191b088d3bc", "value": 190052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764696223, "uuid": "b959fe8c-d24f-4573-b8a6-877765bfe852", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696223, "uuid": "bf50d752-d18e-4363-b29c-1ddf1e883786", "value": "nshkmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc15ae76-cf46-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764656369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764656369, "uuid": "0fb70cac-a12d-43f2-a2fa-d180a4a51346", "comment": "Malware payload (Mirai)", "value": "5d3733203fb54d28d6c1069cffafb517", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764656369, "uuid": "e322029b-4662-4df5-8b76-6930afaa2cca", "comment": "Malware payload (Mirai)", "value": "bd816552555c58a92f68204098dff219f0e1d3220eb67274fb87f66b80daf284", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764656369, "uuid": "4470735d-1f4f-4a23-be8f-abb91382420d", "comment": "Malware payload (Mirai)", "value": "1f27027ce3731bc75451aec0f6c15f952aa1840c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764656369, "uuid": "668d3094-bdf8-4c0a-ae19-ecf5959bb9ee", "comment": "Malware payload (Mirai)", "value": "57898c03c27f70986580faf1b47374a100cf4503dce1f4226aa96c15192aafe6f9551d896ca6057db50b383d5f273ec4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764656369, "uuid": "4aa9e39e-fc4b-4183-b067-fc90f7fafd50", "value": "T13D33D79178D15A2AC6E423BAF9AE408E3321B3E8D1DF7217CC241B047AD552F0DA7B52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764656369, "uuid": "907cd82e-8f5c-46fd-9957-88339d86bfb3", "value": "1536:YGZh1mxMBEfiJo25+J+KEwrKdqnKKUWhK9RP:YGZ++tS+KEwwKPh6B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764656369, "uuid": "d59f34ae-c307-4660-869e-17026aff9290", "value": 51172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764656369, "uuid": "176c09da-940d-4d06-95e0-ec1552d21ae6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764656369, "uuid": "1b1f34ee-04de-42a4-9ec1-b8fd31035aaa", "value": "jew.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3ad420b-cf59-11f0-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1764664462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764664462, "uuid": "49a08f4a-8f46-47d6-aa24-009a101bae64", "comment": "Malware payload (GuLoader)", "value": "9519d0c47bd837af67c8507dd3f23f3d", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764664462, "uuid": "d3e7616d-4b22-488a-a1be-3cc4a26aa69d", "comment": "Malware payload (GuLoader)", "value": "bf58137d133c114702ef79bf5f8757fff9102cdcf8ac1baf12a11c61f79f41b3", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764664462, "uuid": "c7c92119-8e29-47ca-9926-1c76a6d327fe", "comment": "Malware payload (GuLoader)", "value": "d0019347f4ec5eaa22117ad4d340776beed04a9f", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764664462, "uuid": "a9f23d2f-1da1-4387-a8c1-6ba9adb62c53", "comment": "Malware payload (GuLoader)", "value": "3757c768fcbcc01cee214cef62415d66c5676c9441ba93b57dfe9bd5ffa53a92f6be20ef0d1a78bf4ea13c939553bc83", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764664462, "uuid": "ba86c799-a3bd-4407-b194-29d18c0d114b", "value": "T1EE155B60DD2407EA4F8B17DD7C950A82C9BDC20A551754B2F6C90B8E72068DCE3BE7B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764664462, "uuid": "0999d844-40be-486e-bcb9-67cdcf9fb775", "value": "6144:80r40rZ0r/x0r/X0rP0rg0r4M0rH0r/EW0r/a0r/OfD0rX010D0rC0rm0r70ru0m:9b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764664462, "uuid": "a889f634-e78e-46f8-9185-f6c82ed41b8a", "value": 886053, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764664462, "uuid": "f25037e1-a8f2-4caa-9685-5c9bd7ad380e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764664462, "uuid": "1a0af493-5404-46f9-95c0-af239e260f71", "value": "Beschaffungsvalidierung erforderlich \u2013 Bestellnummer 903097802.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19d45330-cf15-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764634998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764634998, "uuid": "db1a4d5e-99c9-4255-bc54-1dda221a0fb1", "comment": "Malware payload (Mirai)", "value": "d20eb7c0422f4310ac1e0ef597b8fa61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764634998, "uuid": "8544d0e4-7b48-4f9d-8834-ad5d2886b62a", "comment": "Malware payload (Mirai)", "value": "bf5c5452bb6e45090de3613355bf2bae864051b25af1b11bfaf7812ce96c74e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764634998, "uuid": "b3b1a957-6d41-4a23-aff6-a889868af63b", "comment": "Malware payload (Mirai)", "value": "badf10c541f3eed2391e13ab1d42c89d758f4e8f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764634998, "uuid": "5c46894e-a4df-4f69-82ef-14ce033cccb7", "comment": "Malware payload (Mirai)", "value": "133fb68968c3e031de2e903326580d113376882540d21f7c1813108df7261a97a8ad96199d138dd4fccb698fc255dd51", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764634998, "uuid": "c42983ec-a7b4-4ba6-aa27-6152e14f184a", "value": "T140936BC5FAC7D4FAED1646312172AF37E9B2E17E2029DE87C3A8D535AC22101C11B26D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764634998, "uuid": "0d5c3cfe-c406-41aa-945e-0cf39aef4634", "value": "1536:2r0gZ7Glep1G61qVvKn4TAWlR3Dyu/kXYaoS3lVs:fgslcTEVvw2AWj3WwkfU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764634998, "uuid": "31a8ec26-cf27-465f-9360-933819a4ebf1", "value": 91476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764634998, "uuid": "b4926ae7-638e-42e7-8f5d-223288b8447b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764634998, "uuid": "965f0ade-762e-4f14-8f90-4be541b7c153", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad158475-cf48-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764657149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657149, "uuid": "bf706620-3d8c-464a-b169-aa61613c52a7", "comment": "Malware payload (Mirai)", "value": "1ccf40bbc143bb19f4040d155f5be2cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657149, "uuid": "db4eca2e-23f5-4cca-b035-27ffb2ad7a47", "comment": "Malware payload (Mirai)", "value": "bfdfd7e7e360d9b500d8bad2be1113cbbe9dce95f856978d56a039f1d9a84c51", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657149, "uuid": "bc75a943-db90-4a60-a142-5d32c0749b96", "comment": "Malware payload (Mirai)", "value": "a5b985fd278ef2ac49a22bf48392060728234ebb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657149, "uuid": "346fcc50-8226-4dcc-bda5-65b517f85f93", "comment": "Malware payload (Mirai)", "value": "dd8f67030648c4d058727ba5943a30c794e145afbc744cf2cacb29595d016a6eef097176291f5112e9b0e78a271b270b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657149, "uuid": "3cb67824-4ccb-4693-ac91-ade84d4ffd48", "value": "T14E11BA26BBE25E2ACC940376DCDB6311B322BA88828DF853A39112021CAF2055F22185", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657149, "uuid": "c0e61632-78b0-47d9-8bf3-6c24a192ec09", "value": "24:V4M18taDEMwd160+FF+i7DDIdHTP7TJIHNfedn:V4M0aDVlF+UnCIHNmdn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764657149, "uuid": "c51758cd-993d-4e55-9d76-f28de2bc0b00", "value": 1076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764657149, "uuid": "81f67241-be8f-41d0-9ba4-11d51ce59492", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657149, "uuid": "e6e5d0cd-df73-45a9-8c98-5b9376f55338", "value": "dlr.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83d46af4-cf58-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764663952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764663952, "uuid": "f58ca898-2ae6-400c-a994-c85fe6ff471c", "comment": "Malware payload", "value": "e771c6495d0bf791b204eac23d58d59b", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764663952, "uuid": "d95ab801-b93d-4859-a990-631e0a1f9d51", "comment": "Malware payload", "value": "c0a22b664867fb8da671f6441260252bac8b7c8f97a61a622c150989bfdc92f4", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764663952, "uuid": "34ee1961-5e12-4472-b22b-b4125258b842", "comment": "Malware payload", "value": "4c8a35908069f361652fcbddef6ec1e65c1b3516", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764663952, "uuid": "aa5318cc-0c7d-4642-a3f7-fcb129e162ec", "comment": "Malware payload", "value": "fee8cec3f20295b869e5e0e347ed2379b214be88ae8af7c797c762c96ccb0866299bdfee5b5ab3bf33933e9d3d17d5e4", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764663952, "uuid": "b82f4e33-c3a8-47d5-8df7-4b2cc2a21507", "value": "T1DDE62287FB44E92FC47790F285AE5622518B4D168E8397437D14728C98B7AD43F8AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764663952, "uuid": "68360331-7071-4b57-a92e-c53936320a1a", "value": "196608:bnxvDXp2b02n+fAQX1HuKbsYIZC7x45cTyjlXzluKrhN81YDqfy1uloi/5:rFN2b02+o4tkZFLjlXzl1hNW4OBCO5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764663952, "uuid": "6c207c42-db57-4582-82df-f74cdf42dbdf", "value": 14418544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764663952, "uuid": "a8272ede-9ecb-40bb-8739-77adeb079c19", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764663952, "uuid": "107770a2-9053-4267-bcad-dddd7258dc97", "value": "Tayro Tournament Gaming.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80baf6d6-cf5b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764665235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665235, "uuid": "da817593-5f01-424b-a94f-0e09fe6586a3", "comment": "Malware payload", "value": "fcf6aa003ab7792e1fd2b41e99d453a7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665235, "uuid": "b63432be-c1bd-43d2-a8f7-0f5398ad0790", "comment": "Malware payload", "value": "c0a9a6692fc61c6befe6a23e9c21735ea8eb2cf1bec1cb827cf2c81d0155e4a5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665235, "uuid": "42ab4d55-e466-45aa-9a5a-3886b455bb23", "comment": "Malware payload", "value": "d90c712ed3fd39cd7aa15c7d17729acb3cdb9738", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665235, "uuid": "d64b0a6a-1a6f-4008-9a3e-097ff445466c", "comment": "Malware payload", "value": "58106479a5ac16ff545c998d06c3cef573f6c6c3f9c03667c2dd775eb5d4ea9bc3911d85ca5fa959cf2e74642ba2f9da", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665235, "uuid": "54d93219-9b8b-4d21-9a36-68dcf4014264", "value": "T1DBD3734062C1B8A403971F76771FB9D5FD3F09D93498498BC161FD90B9B5B0AEAE0A32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665235, "uuid": "c5335bd6-7973-4c90-8a45-9050c099d445", "value": "3072:YbBpBN7kiBka+7xrl+NU8HJBeSZ9W2tmkZJCatDo+tvOmenvWMRaAS/UJ:YbTBdkiWa+7xrl+NU8HJBeSZ9W2tJkai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764665235, "uuid": "8f494a0e-c916-4f9c-87a0-4918d90f7402", "value": 142106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764665235, "uuid": "6b312ac7-cef9-4290-adf2-c993a9eacdf3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665235, "uuid": "14f32b8a-9dd4-49ea-a1a7-e5af3aaa12c0", "value": "Waybill Number_0045643890.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "800a0687-cf90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764687997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764687997, "uuid": "3e88e12b-9068-44ee-b07e-3f3e6a78d62d", "comment": "Malware payload (Mirai)", "value": "d0b3a5c56c1922376d6d102dbb455d23", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764687997, "uuid": "47812935-a715-4133-b4dc-9ca220e2479d", "comment": "Malware payload (Mirai)", "value": "c28b4174ebab5aad08afdfe2fc9cc262fd7979061a3a5f7f95fcb36fdf1f02c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764687997, "uuid": "a0aeced4-4bc4-4de0-8873-25531d96a099", "comment": "Malware payload (Mirai)", "value": "62d732e47750898fe8bae7960369497fb39d5003", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764687997, "uuid": "3e5515cf-e762-43af-b21f-b6b3dfb2e7f2", "comment": "Malware payload (Mirai)", "value": "f9142d2810d84f6a3aee626a2c1391d3f9745b19c77b11f97dda35b8f3d22df1502debe80a90ec2ed2313230a6e9201a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764687997, "uuid": "c0a89293-28b3-4087-bb37-7dfabe81b38c", "value": "T1AEB2CF867F0668DAE95BE0FA56F11F09199217913282ED862B48AFC3544B4FC3D93BC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764687997, "uuid": "23aa911b-d90e-425d-b2ef-51c41ca8e157", "value": "768:Lyyp7rV1VnnCzste6xJK2eJfbw18Zn4U5R2NuDAuBqJgGlzDpbuR1Jd:3TVZtI9lbwaZn4UuqAVVJu/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764687997, "uuid": "abc4045b-92a0-494f-bb34-454522d763f4", "value": 24968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764687997, "uuid": "4df609fd-ef89-4836-9613-ef587667d07c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764687997, "uuid": "a986b056-bf51-4185-84bc-d40a82d3ff5c", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab15c3e5-cf48-11f0-a129-42010a9c0007", "comment": "Malware payload (AISURU)", "timestamp": 1764657146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657146, "uuid": "56019a0e-b8a1-4e50-ac94-88a670ed3042", "comment": "Malware payload (AISURU)", "value": "bc5bf4d8b369eef9510d3c86867ef5af", "object_relation": "md5", "Tag": [ { "name": "aisuru", "colour": "#B49DAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657146, "uuid": "f96ac0ba-602e-4992-912d-65ea2537b857", "comment": "Malware payload (AISURU)", "value": "c2d5b05659726d788cbfdcb8585f645096f816a65e39e5e3230c030ea1e628c9", "object_relation": "sha256", "Tag": [ { "name": "aisuru", "colour": "#B49DAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657146, "uuid": "0a4c2f65-7fff-409d-9bda-bf3f2f07cb6d", "comment": "Malware payload (AISURU)", "value": "b48664e9ea3a3734f974a4da29af506c4f7e4759", "object_relation": "sha1", "Tag": [ { "name": "aisuru", "colour": "#B49DAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657146, "uuid": "747813cd-b0fd-46b9-81dd-b0eaf57e6c84", "comment": "Malware payload (AISURU)", "value": "6ec636a4aae6d62bc8d4f40a8e1a83a3fb223c9ab3543d578afdd4046edb5f1407b6e6ef16dc127927c9f938b65a8c70", "object_relation": "sha3-384", "Tag": [ { "name": "aisuru", "colour": "#B49DAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657146, "uuid": "7f93885b-42ea-4ccc-8f54-ed0b20c1b5b5", "value": "T15BE36A55F797C0F0F3A381B6002AD3B76A7488119226F1D5FF893B31B836616AD1A39D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657146, "uuid": "681e9b12-b064-4263-b8db-cbb0dca5158c", "value": "3072:KccaOEi32Ntqb20sGNM6bZHzyarj8VsUI/moQbpu5VD:GEi3KtYwKbpljW3a5VD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764657146, "uuid": "5b64b44a-f23a-4a80-99f1-f9c7023bc49d", "value": 153232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764657146, "uuid": "10d1cbd8-6a0d-4d28-a286-0666fc225896", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657146, "uuid": "d0100673-83ea-4fdf-ae8f-cf6b48c0cd35", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1476596b-cf49-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764657323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657323, "uuid": "f2c9e61d-452c-4fb1-b1e9-8501294445d2", "comment": "Malware payload (Mirai)", "value": "c166f2837bcd4d2516b246663398dbe7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657323, "uuid": "cbb30fb4-c77a-4a05-8537-acd7129ffc62", "comment": "Malware payload (Mirai)", "value": "c2ff39ba543c54d533f2f21fcbeab062a06aff289ce6a9325c6e4f7482992d2a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657323, "uuid": "c25217d3-97f2-4147-a31e-02ba85d63967", "comment": "Malware payload (Mirai)", "value": "50138271830f3fd76208f099babafc0fc59151fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657323, "uuid": "c7ffcce8-b986-4eac-a483-36f157da3b55", "comment": "Malware payload (Mirai)", "value": "ea7e35451f49759e68aca9437b1895048d5a91230e91976b22964ce49322d68e138a97aba49e46ed4c561efac2bcb1b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657323, "uuid": "47bb90a8-dd99-489d-a3cf-5dc2955d6aa3", "value": "T1B8142A13B307AF52C62A91B24EF3C76D65D721011EA6A5D5E322DB1D2E202D4AC5EFF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657323, "uuid": "28ad4ee8-fe8b-4747-9fd5-c3c09871d2e1", "value": "3072:Rnr0aqo1IkoRvcB482VFmmaarPZ6kTmdf7Ppm:Rnrl4OB482nmN8fm17Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764657323, "uuid": "1a7939ea-2498-4fce-af06-d2e7fa1729da", "value": 202344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764657323, "uuid": "d696370a-06a1-4dd4-baaf-fdd46b1369cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657323, "uuid": "01d811af-d4d1-4781-97cb-a89167f168bc", "value": "bips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "030df704-cf44-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764655146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764655146, "uuid": "e076f2b7-befe-494e-b922-82a27fd506bf", "comment": "Malware payload (Mirai)", "value": "31881fc2e5783128d0ac0b6c6eaae7cf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764655146, "uuid": "37a89ade-cf5a-4aa2-9fce-322e1f197b9e", "comment": "Malware payload (Mirai)", "value": "c311c9ec73ba36bda23402efd6b20a386cf406f845cad82fafa0072d14d48f72", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764655146, "uuid": "dbbf0896-93f7-4341-b5a4-54b5c11fc52a", "comment": "Malware payload (Mirai)", "value": "0ca7869aa0c930bd6857fad0cea76657abcebec6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764655146, "uuid": "e4580bfc-0b78-41bf-bd57-789f4950bc30", "comment": "Malware payload (Mirai)", "value": "47cbb5192e93a64513f69e1d51c7f6b1fd0402d0208a39832415a34ff97b73440d902b70b831e69a98d6f1a91a9e971a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764655146, "uuid": "129fb310-d49d-406b-8262-19a4f1d337ad", "value": "T14ED0C2BD602A34A6AEE9C83CF0B40400301C5E3609388F487D196CE9CBC4243F029F8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764655146, "uuid": "d5d38339-c984-4d95-8bcc-8a07fae05d04", "value": "6:hhcFvAqxnGOmaVXm5EOTAK9qxnc7zVHzlAK9qxnETeGBUtfAv:ncOqAmlvK9qGVzaK9qRGbv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764655146, "uuid": "392feaa6-34e9-4ec6-811c-5f312abfe5d6", "value": 282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764655146, "uuid": "c061b380-62cf-4315-beb8-25a90d48e848", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764655146, "uuid": "e77c0a83-2fca-4686-a69d-8f93cb89cc64", "value": "x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ded3aa20-cf7b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764679137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764679137, "uuid": "e0df5cb7-18f4-4f32-b152-1d0123b8fb68", "comment": "Malware payload (Mirai)", "value": "d87c9b5a919cf8468305bf5822552212", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764679137, "uuid": "72bd756f-25f0-4bd0-ba49-dfdd92c8ab76", "comment": "Malware payload (Mirai)", "value": "c3d72fd23b84551012271c8f39a1be413f12aeb1d4f39119f279328b09769ba7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764679137, "uuid": "46ed7586-8435-442d-b774-4c266a7e6cd1", "comment": "Malware payload (Mirai)", "value": "06f421bc6ffb3741d03abc6022b5d3a467312ed2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764679137, "uuid": "9434dfe5-403d-4b83-8248-6d125b232890", "comment": "Malware payload (Mirai)", "value": "e94e113393170c688b70aaad9cdffbeb503002399712de60443af13e6867422c6ce69221c790b79b7648ce62be780102", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764679137, "uuid": "d799abef-9fdf-46a7-8e6d-ebf1091440e7", "value": "T1B75302535163B8BDF8B565FF142AC159494ABC77320B23F60ABC50ED8CEA2214F235E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764679137, "uuid": "821bbf46-a130-453c-af5a-79c6fccfc8d1", "value": "1536:qTuQBCAzJNSup7JtimuDzhs83lSshbX8rBuaKQ1bhKbdf2DIx:qThMkJZ1timKtXsshbX8rBhVMV2kx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764679137, "uuid": "3f5365aa-b0c0-4a3d-8600-abbe2ed33387", "value": 65292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764679137, "uuid": "10931a3a-c1d0-48b6-afcf-cfff79a0bee5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764679137, "uuid": "03a7634f-b5d6-4ff5-a265-7683325927f3", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "499a15ba-cf2f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764646245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646245, "uuid": "bba2fbcc-a0f1-4ab5-87b1-052ce6859a86", "comment": "Malware payload (Mirai)", "value": "4783f31890520d79c5f9db4d6fe7f5b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646245, "uuid": "c32bab24-6554-45b3-8321-3a86e4c592fe", "comment": "Malware payload (Mirai)", "value": "c3d7b8c27b9fbb35912f7d031855df3103ac723ee28ab5a43c642aae3f1df071", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646245, "uuid": "490b41a9-1f02-44b0-a5d4-05f011864f0a", "comment": "Malware payload (Mirai)", "value": "247b37b924e918a2e6e881b012560b08d2a62bf9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646245, "uuid": "bb60732d-80dc-42bf-9802-e733fc2853c4", "comment": "Malware payload (Mirai)", "value": "3da7e1127df08a61fbe9df79832697a15b1816526ff0dbe7f7098e618f82a6395e3b3c2bdaa1dae98af6c1c896d41407", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646245, "uuid": "3da2e0a0-ab49-4760-b01b-b8b4cb8ea160", "value": "T1103318C4E903D9FDDC5619712137EB328772F13B1029EA87E7ACAA22AC46B41D44729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646245, "uuid": "697a3e74-a857-4222-bd94-dc50bf9a3417", "value": "1536:O13kynNjv6czSEZeLmI37KNCgoT9poQzWxS2RAfah5XQ:AUyntv6cuEZ437KAgohpoeiSi1D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764646245, "uuid": "9885d8f8-d1cd-4fa9-8d3a-2a1f600271d8", "value": 54864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764646245, "uuid": "846e248b-c3c3-415c-830d-d9befedacf76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646245, "uuid": "754d90fc-0383-4b97-8ba0-067702c691cd", "value": "jew.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5236678d-cf75-11f0-a129-42010a9c0007", "comment": "Malware payload (OffLoader)", "timestamp": 1764676324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764676324, "uuid": "1e273247-458a-4432-a7ea-ed20587615fa", "comment": "Malware payload (OffLoader)", "value": "5b77eef5c260e68b1e376b10876f27ef", "object_relation": "md5", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764676324, "uuid": "4e3b301e-4a77-45ab-9575-9161de1a4367", "comment": "Malware payload (OffLoader)", "value": "c3db0f035cf37feecce89bbad6c84be4e6c8385b7799b464651681dbd2a0db85", "object_relation": "sha256", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764676324, "uuid": "dec8126d-8126-4534-b740-9c6e05fa824a", "comment": "Malware payload (OffLoader)", "value": "011d98207f40961f6fa3e358cd9824d1fdb3b37b", "object_relation": "sha1", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764676324, "uuid": "e10eaf42-c105-4ca4-9fab-52bb82ef3838", "comment": "Malware payload (OffLoader)", "value": "b78b908a873e930444749cd2c1c249b35e0c624b0e522529b92bd694beb38c6637607fbd9898543e6a13dd7b677ce345", "object_relation": "sha3-384", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764676324, "uuid": "f3943d37-55ab-4ad6-be9d-5d2ed98ee029", "value": "T118361233B28A673EF06E5A3B59F292205D3B7A50A41E8C5696F40C4CDF2E0B01D7E657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764676324, "uuid": "49203c2d-08a4-4e66-a3b3-883b9c64ee58", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764676324, "uuid": "15caae67-9676-4d09-a89f-1106978fc679", "value": "98304:8N66AOmV4g+X+4RJVlg4HNm0tzqGQ9AEpIH7IwDCri+iwaA8NVPenQyU:4ALV4h+4RJfE0tWG2i0wOoByTU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764676324, "uuid": "cd03d077-6fab-4816-9b75-1b16689e270e", "value": 4983223, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764676324, "uuid": "1d341a9e-6564-4763-9509-d21f64f6a1a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764676324, "uuid": "d70cc976-6125-4b95-91bf-d88662144d1c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c380b495-cf37-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764649885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764649885, "uuid": "27674dc2-5d45-4d0e-8995-27785c9372ce", "comment": "Malware payload (Mirai)", "value": "630d92c6270a124a16b2a852d5a00ffe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764649885, "uuid": "1ac7568b-e198-4b76-8b17-c141e9ebabdc", "comment": "Malware payload (Mirai)", "value": "c46a7e01e2c40e63ad9e2ed2bccfd00f3035b1c1cb435b00a06db3502c27d456", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764649885, "uuid": "10bc7572-4b8f-4a09-a917-197c21e96bdc", "comment": "Malware payload (Mirai)", "value": "a2540b038e5dc0a8c199e59372518a0271f6e73d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764649885, "uuid": "34e7017b-1ff7-4dca-9dde-35e17dde5af2", "comment": "Malware payload (Mirai)", "value": "5c08cc0001cc8413bff8341849c9621b79900bf0aab1c152c9935884a4c8d84dbc31fd4e24b75a6aa3863d381edcfe1a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764649885, "uuid": "1f77bd43-30b6-4308-88a3-c668c07263f3", "value": "T1A7530293736AC5A9D99F133B41BB47705298B4FE5910D0752AC6E4000077C3EFE0E99E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764649885, "uuid": "ead5965b-70c1-4f84-8585-2392453237f5", "value": "1536:t2ipCXgoS86B46AU4Nibm1AE56nuJA/MoB0j5ifEiCLqMsSp:t52girNaEKlM9iCLhp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764649885, "uuid": "817f22a1-e71b-44de-8c94-a9f055c3b242", "value": 61540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764649885, "uuid": "98be8ee6-94f4-48d8-b31f-7105bbceb0eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764649885, "uuid": "1006c166-1ec9-41a5-9cbd-df31a651b16b", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7390b55b-cf58-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1764663925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764663925, "uuid": "d6f56f83-dc51-4340-ba30-74cc6a74efb8", "comment": "Malware payload (AgentTesla)", "value": "50faac194cbf296535c233ebb375155d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764663925, "uuid": "23b4d906-d915-4463-87d4-124e931a8af3", "comment": "Malware payload (AgentTesla)", "value": "c4864d68461917c43fd7dfbb35a5ffa28143e2f855e599dd59b87a357b0e758f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764663925, "uuid": "acf65c69-92db-4017-a7f1-addc91d38769", "comment": "Malware payload (AgentTesla)", "value": "9c523c9b0ae72c720753363b48061381eebfa8bd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764663925, "uuid": "19f40652-46bd-4730-838b-36177d70c219", "comment": "Malware payload (AgentTesla)", "value": "0c79d0fd722e9a25ffa592f482ac2b3c3177043b957a86cd540b570e742d26f7504fa5683d8b23f49d3162dbdfa9c17f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764663925, "uuid": "d1dcc354-7af2-402a-b9aa-82845e856c4b", "value": "T1220533A27DC23241299223BC5FD16ED243AAF1DF47002D46853B6523BD586A21FF2E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764663925, "uuid": "27979069-f4bd-4e5f-8d7e-a803cd602759", "value": "12288:CIj3hIwmB8cuSXD5eGXHnv7IYM/NR1ngKYijMVAGwilzC2t4:tr9sXHv7IY4Whi48KC2y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764663925, "uuid": "935e5595-76ec-49ae-a5a9-e78d9d16e9dc", "value": 831700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764663925, "uuid": "18c24af8-41c8-4c1d-b4a9-8dbd116620b4", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764663925, "uuid": "c016e01c-3b19-4264-bb45-7831128ccb0e", "value": "DSV SWB Sea Waybill - RAF0049122.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9838b5c7-cf2f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764646377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646377, "uuid": "6bbf1b38-240d-42cc-b942-cea8859c0b56", "comment": "Malware payload (Mirai)", "value": "c9e978eb6292f67c77a4ae5af5dceaa4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646377, "uuid": "01de406c-9d05-4ef4-acd4-cadadea6a77c", "comment": "Malware payload (Mirai)", "value": "c4f22d49dfdc033368a66c2f327c70df703ecd2336727dc1ec4879b4e565de63", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646377, "uuid": "23175ad1-1d07-493e-8046-b4a79d7c10c6", "comment": "Malware payload (Mirai)", "value": "0bebe4605b6f2fe3ef449100bdb6123eaf5d3ecf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646377, "uuid": "a8e426bd-a6f3-4648-847d-db8c207874bb", "comment": "Malware payload (Mirai)", "value": "8d660a553a36ac7a42a112f5154a9c9c5988e608f801ae56329a523817208548f04457077e3669115fb5457e19c53632", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646377, "uuid": "3db65556-f0ed-476c-adce-f6e91a54c67e", "value": "T175C33B46EA409A17C1D2177BFEAF01463322D755A3DB730689285FB43F86B5F0E63A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646377, "uuid": "e9d5c33f-5358-4250-9602-72d1f878af34", "value": "3072:mFO2Wm+DiWW1X1GBE+f37NpUVj7+SmqtnM/91QdPo/:32Wm+DiWHBtf37Np4j9mqZM/92Bo/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764646377, "uuid": "dfce5301-dd1d-4b50-a23b-4a74e86a7dc4", "value": 126156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764646377, "uuid": "53b776d3-7d44-4e24-8a1b-b8f10766815e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646377, "uuid": "5b49bba9-9ac6-4263-a909-bdb59e7788cb", "value": "3atoNational.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4a59ca1-cfa3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764696246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696246, "uuid": "a4865206-6a3f-47a0-a89a-4a327e277952", "comment": "Malware payload (Mirai)", "value": "4a8e465176ac031adc9881ee740fddbf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696246, "uuid": "37cdcf1c-1867-4b4a-a0aa-783281a0295a", "comment": "Malware payload (Mirai)", "value": "c5e125a74a2975c29b8f2a8c4bf61c97373857b59644a993f57e8f42e4e1dd0e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696246, "uuid": "de41758a-ae67-408d-96a7-89d11c633e81", "comment": "Malware payload (Mirai)", "value": "18b4108f901b432ef9eb14586f7a7cfd7ae49dbb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696246, "uuid": "496c652b-36e3-4f23-bcbf-877adae4d788", "comment": "Malware payload (Mirai)", "value": "600ba36e43f98af73df15963db8ceabcd3f97fb09d7e3e0c0d5797f0152e6a3d1df7ff97e1a05c5d6cc3f34ffd4ae047", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696246, "uuid": "9f341509-3202-4c47-9199-45e6265f97c0", "value": "T113E32B06B30C0947D1632EF43A3F67E093EFEA8121E4F641255FAB8A9171E325586EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696246, "uuid": "15d78daa-c781-4259-940a-06a7a8714f49", "value": "1536:wjCMt9opttgdeqvcisxx7xUqAqJaCY/vWr0QRWTdIrD6/tvA58+zERu4ishxqNEU:wLeJiyx18Bk0QUTq+S5m8L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764696246, "uuid": "a88c7c1f-deb9-4fd7-960b-fd62b0a8de17", "value": 146128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764696246, "uuid": "23345a20-776b-41b3-81d0-ba524274d475", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696246, "uuid": "44c63b20-0453-44e4-a541-b007d61836f2", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f3c520e-cf37-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764649771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764649771, "uuid": "41213530-491e-4e01-aad0-859d2d803002", "comment": "Malware payload (Mirai)", "value": "5c84f7a4affd50cee7acd1bfc09c75fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764649771, "uuid": "a52084aa-f99a-40b2-bcd9-ffa1064c2485", "comment": "Malware payload (Mirai)", "value": "c872e99dfd6681055a7d351ac25d9ad1d05067cfec321b20f6cd4ab668d8f6e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764649771, "uuid": "4e60e4d3-404e-43b7-90b1-016b67bfb38c", "comment": "Malware payload (Mirai)", "value": "b524b2f163a978f10dab811f72e3b9ea1be12147", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764649771, "uuid": "77b1c03b-ded7-4b91-9b8c-67f47965ae5c", "comment": "Malware payload (Mirai)", "value": "021fbc400b0fce5a511680509e6302aca00ef880b6d78c67120d195c0f73fd1d418fdbed9dcb968eba9c3293a08dd5d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764649771, "uuid": "914adeb7-5fa1-45cd-ad12-ba1c47942453", "value": "T12FC3E098FA175981D1A302FE98C056C293902E76CF62474803A9F7B83D39DF60F94EE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764649771, "uuid": "8e6f7a28-8b25-4f07-8b7c-13165f5541cb", "value": "3072:d5m4LLivOWno6M8fN17pXu7SXrG760M0rMp9MMTnS:a4/+oEfVu7GrGJMfxTnS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764649771, "uuid": "0141ca06-0330-4600-a9f1-855cf64c295c", "value": 123768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764649771, "uuid": "11f26ec2-3d1a-4067-938d-bec5622386b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764649771, "uuid": "40530c6e-7328-41a5-a551-66a178a19815", "value": "xnxnxnxnxnxnxnxnriscv32xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffb2a9dd-cf92-11f0-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1764689071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689071, "uuid": "bda2013b-dc0b-49b0-ad43-164517d6c428", "comment": "Malware payload (Joker)", "value": "a61e5ed23afd6ad08ad2726d14103916", "object_relation": "md5", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689071, "uuid": "c1f45df5-0590-48d6-a336-b12bf4e6052a", "comment": "Malware payload (Joker)", "value": "c8fd625b914416e5570c4850ca5be914bdb671e0272458d830009c493976222b", "object_relation": "sha256", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689071, "uuid": "f77c9d24-9add-4598-83aa-cec263f828f2", "comment": "Malware payload (Joker)", "value": "03058e219f41b8805802a0e43dd236496e9e1751", "object_relation": "sha1", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689071, "uuid": "a7de0dcd-7103-4df2-b4e3-02bdb3ea754e", "comment": "Malware payload (Joker)", "value": "9a270953ba1eb92eb7f9cb12245757e2b6d654be54c03371473d22cf347e4da1824acdc72741457c25a0d8787962995e", "object_relation": "sha3-384", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689071, "uuid": "b955c8f1-0bc5-497a-b2f9-eab4de3cca61", "value": "T1ED87126EE70D7826CC7AB07A9D5A363532592CB82701D3E72501B2DD38F36E08759BC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689071, "uuid": "e29360ce-e8bb-4978-a8e3-28c5a18ea9c9", "value": "786432:PoWNvfJYw5KgsMnHHclvttMLVBfXCbVNCN:PoWpSm3xctgfXC/CN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764689071, "uuid": "4fc70ad6-74d6-4a34-b765-de3d5a8d52e4", "value": 36023339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764689071, "uuid": "b0372938-62dd-434f-b84a-34e5b963166c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689071, "uuid": "b81191c0-da49-4056-8e8c-49a075c0e542", "value": "Fancy+Cleaner_12.1.2.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1579fdbb-cf49-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764657324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657324, "uuid": "34118f7b-753c-4ce5-9db7-40f45093b705", "comment": "Malware payload (Mirai)", "value": "e4b2d230b2d22e55f2547050b39aacad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657324, "uuid": "2b461efb-e81a-434a-a44f-03401a463b11", "comment": "Malware payload (Mirai)", "value": "c95346a7f6106ed4fc4760f282de456d177491888e2851e39c5bc024768852ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657324, "uuid": "1f1abb77-85dc-4865-99e3-28fd1bddd90a", "comment": "Malware payload (Mirai)", "value": "376c709b1c23e0d6a714f5a5206f0c615334c2f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657324, "uuid": "4514dddd-0d48-41a4-a064-a373a1f067cc", "comment": "Malware payload (Mirai)", "value": "a3eb3cf83db28f03976ea1aec2b4147bc7093a6f23c8b9cc42cc89de2eb5404002aefea6a3e2c659a95e0af87f44d1c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657324, "uuid": "504b517b-0d7b-4a72-8682-06134946431b", "value": "T1F5932855BC829A17C6D013BAFA1E42CD331623E8E2DE7213DE259F21379B95B0E3A541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657324, "uuid": "ee65627e-be48-45d8-bad6-57c409fac397", "value": "1536:EmEC0swnPgq2gP8oaexZpS0Js+4Djw44hdTeczUkAoPiB8OBP:Em/lwnPX2gPXaek6leczamidBP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764657324, "uuid": "db53df02-6dd9-449b-b73e-5a7b9721f8fe", "value": 95712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764657324, "uuid": "742476b9-5060-4009-8a69-537459f7a582", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657324, "uuid": "46427e72-274f-4d4f-b6bc-466ca7301767", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88bc13fe-cf35-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764648928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764648928, "uuid": "19717790-a7fe-4c0a-94bf-676664085267", "comment": "Malware payload (Mirai)", "value": "1a9065ae26b36795895e18cccfbfdfc1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764648928, "uuid": "029f8822-94bb-4c42-8896-48886bd2888b", "comment": "Malware payload (Mirai)", "value": "c9d809a61d3bc65650090615ef48351580eddcf6613c031bf5b785951371deb3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764648928, "uuid": "3dbc0a2a-2584-406d-9c25-641965706d8d", "comment": "Malware payload (Mirai)", "value": "ffcbd8c2abf4d17a372f1f0f3a978c28e66d7d7c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764648928, "uuid": "c7b4df07-193c-4334-ac93-b0044a464721", "comment": "Malware payload (Mirai)", "value": "f202ca84bb84562ebdb86ac352e4180ce612c612f218171cd7283aa3eac0c0f27df49c561978fcd5125fc35d3cdec20c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764648928, "uuid": "1f983296-4d4d-474a-b7ba-46dfdb4aa7ed", "value": "T136C31A47F9929F11D4C722BAFB5E514D33136BB8E3ED3202CD24AF6123C699B0E66512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764648928, "uuid": "3f5625a1-a505-4f36-ac02-f37200d7c686", "value": "3072:z+VbrvW8R25aWodbJiUx42XJ8a15jLNVtEj:z+PE5aWodbJiQ42CazjZVtEj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764648928, "uuid": "856e2f5c-8a93-4fd1-aac2-e966d600b14e", "value": 125716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764648928, "uuid": "249ab650-3bfa-4deb-bda4-b482fca60d09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764648928, "uuid": "6c8c7267-c8d5-4e4f-8209-7395740ea853", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "146e5c89-cf9c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764692971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764692971, "uuid": "fbe7cacd-d0ab-4748-8624-a017f5e7dfba", "comment": "Malware payload (Mirai)", "value": "44165c3b14571277ff73825b55c65e93", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764692971, "uuid": "c35495c8-331c-4eb2-9dad-71de11ad8103", "comment": "Malware payload (Mirai)", "value": "ca27628ea9a1ad9bb42bfdf3778151bc1cd0afdd6a244cdce14bdf197e017efb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764692971, "uuid": "30991e76-4acb-41cd-991e-83feaf2288c9", "comment": "Malware payload (Mirai)", "value": "1133cc5aabf2518e0ee10f1083a562a0922f4ae2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764692971, "uuid": "7e695166-b8aa-4787-91ce-13b623674180", "comment": "Malware payload (Mirai)", "value": "608c2a7ac84d0a9e9c43fbaf3c72093b2cca4cb9f8496acbcbb85e21ccd3d104bf9491ecc3cc38c189d8a844f3ad536a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764692971, "uuid": "50b87b55-7836-4479-bdca-16157afcb560", "value": "T1405161C6B3D24A30FFB15D9A79F6405470C0E09667D3DE86E0FCA4BD494EF095490BA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764692971, "uuid": "8b76d22c-9175-4504-a8a8-3111d97a0775", "value": "48:vXW+WYWOW0WUpzEW7WgWVWSWKWYqUfWLW+Z:vXW+WYWOW0W0EW7WgWVWSWKWYqUfWLWQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764692971, "uuid": "07825ada-cc8f-4952-a988-6715ae26a063", "value": 2807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764692971, "uuid": "95a49413-7bb9-4971-a789-0014886de849", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764692971, "uuid": "5737a2e0-822f-4ca0-aa90-3642c2a46b01", "value": "zte", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d33aabf-cf4d-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1764659028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764659028, "uuid": "964614ac-7fc6-4c92-ac0e-d1af49ce3e85", "comment": "Malware payload (AgentTesla)", "value": "edb4e58f785f1d729670e81fea887a13", "object_relation": "md5", "Tag": [ { "name": "4bagh-net", "colour": "#8CA01A", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "mail-iranlabex-ir", "colour": "#C8753D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RegioneLiguria", "colour": "#4CE35D", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764659028, "uuid": "126abfee-7032-4723-9cb5-18cb2d2b3aa5", "comment": "Malware payload (AgentTesla)", "value": "ca7111cd53e4857fa31e7030c90f75af513c100d48f03f5281b2fe5fcfa677d6", "object_relation": "sha256", "Tag": [ { "name": "4bagh-net", "colour": "#8CA01A", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "mail-iranlabex-ir", "colour": "#C8753D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RegioneLiguria", "colour": "#4CE35D", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764659028, "uuid": "db1a7122-28ec-4409-9760-f7cd2bebaf79", "comment": "Malware payload (AgentTesla)", "value": "a0b368b3ac181136a0aaa2e78ab101dd2fe9c398", "object_relation": "sha1", "Tag": [ { "name": "4bagh-net", "colour": "#8CA01A", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "mail-iranlabex-ir", "colour": "#C8753D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RegioneLiguria", "colour": "#4CE35D", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764659028, "uuid": "8778162d-5469-434c-8a5f-6e045a5cd344", "comment": "Malware payload (AgentTesla)", "value": "7572c93d3ecb55043a2b84888481be33e0755e9a6f77799160a9d31d2a1280a6c73fc15c53da1836bd88de989bdde2fd", "object_relation": "sha3-384", "Tag": [ { "name": "4bagh-net", "colour": "#8CA01A", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "mail-iranlabex-ir", "colour": "#C8753D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RegioneLiguria", "colour": "#4CE35D", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764659028, "uuid": "57277746-fdb3-4eef-a29c-5ebf0e7e19f3", "value": "T14513F14D730046256FA4EEBD42E605D44E5F42A4E0245205BDCF21E7BFA4BE7A878F47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764659028, "uuid": "6f1d28f1-73ec-46ac-8d77-d611e22b8ffb", "value": "768:xHN83mkTMRS+V4jRTcHB+eNVFaOsQ3GFlzHRpFWRmEeZicgYYGuHnTo2x73EjtQH:xHNbkTiSc6ULGFlzHHK2ZvJ3U3h3EjtS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764659028, "uuid": "05ba674d-ca93-4897-9e1a-574a1a6b7196", "value": 45189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764659028, "uuid": "d6769b25-a898-471d-b120-5263df48bb04", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764659028, "uuid": "561ab22d-a737-41cf-9e83-eb5897ae20cd", "value": "Nostro Ordine 264418.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3529858-cf4d-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1764659280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764659280, "uuid": "0395555c-f6c7-4fdf-a6c1-754af0cf624b", "comment": "Malware payload (QuasarRAT)", "value": "6bab2763603ee712bf9edbc5b6872c82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "seguritypostload-duckdns-org", "colour": "#0A0D5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764659280, "uuid": "6edb8eca-4cbb-4e34-9ce4-18a605f05581", "comment": "Malware payload (QuasarRAT)", "value": "caf7254ae621cba9189e65295b25a272fe122e1ab2f3d05ec65dd0709b23d52e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "seguritypostload-duckdns-org", "colour": "#0A0D5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764659280, "uuid": "6190658d-f8ff-46bd-94bb-baea1c19ff94", "comment": "Malware payload (QuasarRAT)", "value": "206b251c6fac940a925cd19d4b50a760c10f8b33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "seguritypostload-duckdns-org", "colour": "#0A0D5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764659280, "uuid": "aa1476b4-a8e1-4324-ad93-f9adaaf3818b", "comment": "Malware payload (QuasarRAT)", "value": "ef737b2330e5b386699345edfd9bbb687c0db7e9b0203b3e007f3448ff7e6fc51a071282376dc06d529de32dca7b3a24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "seguritypostload-duckdns-org", "colour": "#0A0D5D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764659280, "uuid": "ce0b2dd5-fd3a-48d1-acd0-29a904a0cf7a", "value": "T1EF749D13B7A4E93BD1FE1B3AE43206145BB0D8C3B616E38B5A5856B86D133868D513F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764659280, "uuid": "c3e1f447-29c7-49f5-8006-9c6eff23db5e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764659280, "uuid": "7c9377fb-6c25-4c7c-bcf2-96ca7a117c71", "value": "6144:1OqQ4i1FFiEKqA9NHQEAwSblE9eYM/kh4NDZNhipW:EpliF9NHCwZg/m4PNopW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764659280, "uuid": "ba474b74-b989-4727-bd29-723bb6bcc887", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764659280, "uuid": "d0397c15-5a5e-404c-a273-ea553fbc7b66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764659280, "uuid": "b087d2f5-3c4a-4387-9385-50c86e110f5f", "value": "caf7254ae621cba9189e65295b25a272fe122e1ab2f3d05ec65dd0709b23d52e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aadc81ae-cfa3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764696230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696230, "uuid": "316eb236-10eb-41f2-95cd-62dbf249a790", "comment": "Malware payload (Mirai)", "value": "2242ee4867af39b9555a6554ef4d2f50", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696230, "uuid": "2040a45e-b582-4f1c-99b4-9a7fda251e23", "comment": "Malware payload (Mirai)", "value": "cba85dd06e0877b49939b55a9746dceb56aeb5af00fabec3107d8d9e18e95c16", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696230, "uuid": "94427833-bb72-4b7b-bcbc-e25606a7fb7c", "comment": "Malware payload (Mirai)", "value": "8fdaafa9e5091c903d14f4d99cf96cf16b9d50cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696230, "uuid": "452e67ab-2d66-44f1-98b6-ab19d028a175", "comment": "Malware payload (Mirai)", "value": "055b82ae4737be77c7df80c492a461c45388163ec2c4ac4181f7cbba2c136428ebcc67b8a11cbb31aa0399a5be1fb09a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696230, "uuid": "d2df8f23-3170-4da2-b650-f33ba330c31b", "value": "T12DD31A45FD805F23CAC112BBFB5E428D772A5768D2EE72039D256F24378A95B0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696230, "uuid": "17697148-e7f6-42d0-8c17-8fac737366bd", "value": "1536:6rlG9EUz2CPGZ53ZkHSW0S2GC24VAmbTJn27QrnQHwJHfleowywT1/raIgd3Wcza:SlGCbUHh0SL4Tbdn27QsH4ApsV1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764696230, "uuid": "184899f5-aadf-4665-9e7a-45639224d45f", "value": 137824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764696230, "uuid": "9db02ed4-aca2-4445-adbf-9364cd9058a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696230, "uuid": "c6b7a917-99de-4780-abc1-84f14cf0729f", "value": "nshkarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7626cdb-cf90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764688063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764688063, "uuid": "3035caae-aac0-4bb5-b3ca-54ced9e1b164", "comment": "Malware payload (Mirai)", "value": "d85cc135502bd60243e873be17287a17", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764688063, "uuid": "86990be2-9759-4308-9038-55165e9ce3fa", "comment": "Malware payload (Mirai)", "value": "cc89aaa6f057f4bb80f037f7b1ad17bb30a38089e2133debf20c816de5f0f762", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764688063, "uuid": "24e9a2cc-f20b-416c-885b-0306b7422676", "comment": "Malware payload (Mirai)", "value": "017accaa819a9c57c21435951409b30b5c1de467", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764688063, "uuid": "03271253-952f-4864-9f6d-649197a5229c", "comment": "Malware payload (Mirai)", "value": "4e87ce24ca5c5fe90bfe8800b2de91f518159a2bcc4f162dda59c1c634b6674de073db6dae614248d161fc304eab0f0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764688063, "uuid": "3caebd67-81b1-4bf3-ac89-0b5cee9fb644", "value": "T13C634069F8424723C1D31275B59DAE8E3F3023D4B3CAB117ABB14BB039E641B2C56D99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764688063, "uuid": "ba36c253-0b7d-4db2-aea3-5b0c08924e32", "value": "1536:YKbdzDmvSu6zQvWMl89mbJGhiQcb92To:YKoptFEQOo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764688063, "uuid": "b3f2313a-ba91-4be8-be31-f21e4048acd9", "value": 67900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764688063, "uuid": "ae2cbfc8-ff8f-4e52-973d-5e52586e6bb0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764688063, "uuid": "122e8e28-5155-4403-b705-00d3c9680346", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1734a5dd-cf49-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764657327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657327, "uuid": "fd455dfe-ebf8-4508-80d8-14bbf5606892", "comment": "Malware payload (Mirai)", "value": "ea20f43beed3dc032252d8b1587ca2dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657327, "uuid": "95567a69-11c6-453f-9bef-ff1bfb5fc272", "comment": "Malware payload (Mirai)", "value": "cdbb9c9e15bcc1361dc7acc5fe75643b6728c64ff4a200631d06c67c6a7053af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657327, "uuid": "1a9f058f-c8d3-433d-8914-1d1a798bef2e", "comment": "Malware payload (Mirai)", "value": "b5ea9d15e345062eb01830192af8490c52ee717b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764657327, "uuid": "97c74edc-e002-4378-84f4-c0d98b66b8fd", "comment": "Malware payload (Mirai)", "value": "c4ebe0c11f3f2b76b57c71778f2bc17375a6dbca71991327c428f6aa3efb2e877734cc793b5c49a5dfee7242d197e844", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657327, "uuid": "992258d6-24db-478f-ba61-1206e44b59b8", "value": "T1DBC3D60ABB610EF7F8AFCD3745E81B0635CC685622A82F357674E928B54B14B0AD3D74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657327, "uuid": "4d685222-3852-4489-bf9c-4ff29e87a937", "value": "1536:NjjuCNvaaZoPaNBTe1JpRMJMqX1frsAmvTiH+H5vUuiyBTiOxNBW4qZ6WJheEPcQ:NjhnZoCu1JpmJBXyZsuieqNoBVuJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764657327, "uuid": "9bba1f99-abf6-4b7a-9e3c-c2d4629fcfbc", "value": 125076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764657327, "uuid": "840f2c95-0c51-4720-a2ad-a3a526ad2c20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764657327, "uuid": "6b01e602-0510-4c73-a6e4-e53741aefa8d", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa570dbc-cf3b-11f0-a129-42010a9c0007", "comment": "Malware payload (Kimsuky)", "timestamp": 1764651561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764651561, "uuid": "ff2a2324-74ef-414a-9471-f361b6908ff3", "comment": "Malware payload (Kimsuky)", "value": "5f5f868d339aeb58c613fe7eb55e5432", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764651561, "uuid": "5221f63c-3c76-4162-9f39-e437b13a54fa", "comment": "Malware payload (Kimsuky)", "value": "cf98f65f2b87eddca5e763e52b55d7fbb0dd2b03688d7501555cf7fb668f5477", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764651561, "uuid": "30aec6e9-c809-406d-baff-521f3e8aec9d", "comment": "Malware payload (Kimsuky)", "value": "1069ddda13179fa4ca3909f379a2741124bedf24", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764651561, "uuid": "1bc0e237-a214-47c3-9fea-574793aaf421", "comment": "Malware payload (Kimsuky)", "value": "2e6409b00aa5189acdb9c9e195aa14cbf0e2acbc9295c72f523f9131256d9de402042eddb1ade1a09fb7e8545743e03a", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764651561, "uuid": "a5553eb9-3875-4778-887e-3f096533651e", "value": "T1F3848DB74A57FCBE3ABC2D80D8012E491E1C3947162C9259FEC960BA73E9E54CD2D970", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764651561, "uuid": "332a8e4d-ea14-4798-b759-5425b95a2e2f", "value": "6144:qCsBoMhEz5qQsYFninzXOIz4m8SNwO2m5mxzIghV4iTDGSTT431YJF3dO6+tVQb1:qCgIvW4mum57+DE3YWVd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764651561, "uuid": "aef04b1e-acf9-492a-81f7-93274ee10b66", "value": 391168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764651561, "uuid": "a5253295-60f5-4c3a-b75f-b32c68d1f648", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764651561, "uuid": "8b6268f2-75cc-4242-9f94-c13424cb2aea", "value": "cf98f65f2b87eddca5e763e52b55d7fbb0dd2b03688d7501555cf7fb668f5477.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1010640-cf52-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1764661558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764661558, "uuid": "b5166964-d320-4ff4-bdc4-8f71b0328cca", "comment": "Malware payload (Formbook)", "value": "9d2fd1145e4c2054b805f0149fc0a7e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764661558, "uuid": "3532e15d-4fc0-469e-8073-a665c4b0a12f", "comment": "Malware payload (Formbook)", "value": "cfb9c7cf496ca45f0ea7f80ea3d06e19614227d346a05feb7abe00701e23a4b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764661558, "uuid": "63cb03b2-2dad-4f7e-bfa2-220c12290532", "comment": "Malware payload (Formbook)", "value": "ad08487fa9b61a55aee48f8fd04dbaeaccf433e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764661558, "uuid": "6604a90a-5069-4d71-8828-f507f20964ef", "comment": "Malware payload (Formbook)", "value": "c0c41b32d62ade541969211b1cfabedeee41d5914626b6a8bad842c2e1dbea1d466d3f663eb6cb99c7cdd146a5d9885c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764661558, "uuid": "533c5a6b-775c-414a-a282-e125a0691dfb", "value": "T12845BF0273D1D062FFAB96334B5AF6115BBC79260123A61F13981DBEB9701B1463E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764661558, "uuid": "07688ff8-1c0e-4cbf-a8e9-e83966af4679", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764661558, "uuid": "da6dda95-16f1-4b17-8dfc-5d7211384a9a", "value": "24576:Z5EmXFtKaL4/oFe5T9yyXYfP1ijXdaNrOiQXOwFDy5/+:ZPVt/LZeJbInQRaNrj6JFDy5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764661558, "uuid": "a43ff335-2754-4730-8a1a-742b6b671861", "value": 1221632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764661558, "uuid": "6ee77a0c-9753-4b08-ba96-f15e8d7aa9f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764661558, "uuid": "cb2cf143-bf2c-44fe-8ed0-dac64219cfcb", "value": "Purchase Order -813r79.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de4ed062-cf46-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764656373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764656373, "uuid": "8cd7f152-0842-4da1-aa72-6283323fbc9d", "comment": "Malware payload (Mirai)", "value": "aa520fc3c55a62fc5334b9fec0b27957", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764656373, "uuid": "03d1674d-6d38-45e1-8276-65b9b7b583bb", "comment": "Malware payload (Mirai)", "value": "d003732232d8cced0d8e24f165119bb9a8f62c45e050424b624ed0620abaa0e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764656373, "uuid": "39efa7fc-61e8-4861-aa22-ef49166b016a", "comment": "Malware payload (Mirai)", "value": "a188c0a3b25d0f0c1f2405c71a19940e9a12010c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764656373, "uuid": "a7396481-8a7c-48d8-b207-cd886b5c231e", "comment": "Malware payload (Mirai)", "value": "e6b30367828c514995715a5092fc95c632373a5baff0e29c6e05f8e36ad428681172403fd1d56e69fdabd0027ad14879", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764656373, "uuid": "e523067a-3fdd-480c-80dd-bae037b32174", "value": "T1E5334AC5AB93DCF8ED1506713177EB328B77F03A612ADAD7C3899523A842B01E50729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764656373, "uuid": "001646bc-86f3-471a-9243-914f5ff077cd", "value": "1536:3hSgebzgP/AY+39afOsMJRdnhN66OQ6xpwhNbr/0:xZebkP/Ad39UMJRlhN7L6bIbD0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764656373, "uuid": "6e3b526e-d7be-479c-bba9-82cb460853a5", "value": 50608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764656373, "uuid": "87099cd4-cce8-4192-a42f-db037f727540", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764656373, "uuid": "9d9869af-b27b-4480-84e2-e22fbe6556d5", "value": "jew.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0df5c08e-cf5c-11f0-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1764665472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665472, "uuid": "432b62c5-c626-493f-8a18-d2b9e2c8349a", "comment": "Malware payload (PhantomStealer)", "value": "fc9f82c3268eb2034f059d9b8824c2b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665472, "uuid": "e2b2f6f0-f674-49e1-8c4f-d1a4f9678665", "comment": "Malware payload (PhantomStealer)", "value": "d148029876d188723e36c78c56da70af1dff11ebd406fa742c33a33d7a4b77bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665472, "uuid": "9caa4705-927b-4236-8cc3-036373fa2b75", "comment": "Malware payload (PhantomStealer)", "value": "be9950919e46680cfb4b23326f536113b0745594", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665472, "uuid": "9bc6b99d-1e2a-44d2-95a1-02ce596d6120", "comment": "Malware payload (PhantomStealer)", "value": "0142014235bb15a21cb0a56f3991bfff02323368d6b12345fd5ee2ab5d148ed3be98cc14a6f2733c6cfa3d5b37c3d2f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665472, "uuid": "dd1ef632-b875-4db0-af06-2d1082809967", "value": "T1BE75D00273C1C062FFAB92734B5AF6115BBC79660123AA2F13981D79BD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665472, "uuid": "27c5039d-ee54-40ca-ae5f-23984d88db64", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665472, "uuid": "300f3d9a-dd0a-4db2-9993-e66d3928a6b8", "value": "49152:TPVt/LZeJbInQRawLI3omWTTcBtSucqwcNbB:DTYbInQWYmWTTCPwc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764665472, "uuid": "f8985403-7c71-41c3-8775-0be8ee449717", "value": 1654272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764665472, "uuid": "4f92b13d-3f8e-40a7-985d-3581f38934f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665472, "uuid": "852bae35-e802-44a7-b64b-f3e8f658d408", "value": "ENQ-2025-SQ-00041-R01 RE T98.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05d76730-cf94-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764689510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689510, "uuid": "6e7f7248-317e-45d2-8918-f646294276f9", "comment": "Malware payload (Mirai)", "value": "425c1cc3df984072ef921ad9ac671928", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689510, "uuid": "6a814891-a9d4-43df-8ec7-8ae87b0a224f", "comment": "Malware payload (Mirai)", "value": "d218e19014e272aa7becbae8c1aa94ebeca15a0b53d31acc90fee931a0cb988e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689510, "uuid": "896b2e67-85b1-4f18-b93d-563074fb1f33", "comment": "Malware payload (Mirai)", "value": "91d37992a1cd12ed698e035b6a1bf8b0fb5969a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689510, "uuid": "ec7ef792-3806-4f93-8b20-734464a9d0b3", "comment": "Malware payload (Mirai)", "value": "c55b146b818308eb16747b76b5887b71de10f055f6d9757d08c25ff688064a03d0284d6e7d8b4e7b2e1c85057daceee3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689510, "uuid": "f27dad2a-e3ec-4a47-992f-c2a89a43e88f", "value": "T1C173026B13E5C7B9E4FD1239413179C60034D30579E4AA6A7A4DA07E8CE9B037C6ECB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689510, "uuid": "86543e6c-4b1c-423a-8c85-27e291c2cedc", "value": "1536:FlPYdoG9PLxzaarUpHMQMi6nM/rWs65pPUkqmMRefgnouy8Gy6:zYdohSmFrWNUkqwfIoutO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764689510, "uuid": "11ca21bc-e0f2-4322-808e-504cb5ac3a23", "value": 73912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764689510, "uuid": "d1c64d1a-b376-4ee1-951b-b2b531cca88c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689510, "uuid": "6adc164b-aeaf-4cef-9793-0a119ce34fb4", "value": "ecco.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95c231f9-cf6b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764672142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764672142, "uuid": "3360e47e-0412-4ca5-8387-58ea4312443e", "comment": "Malware payload (Mirai)", "value": "321c06a7c773641f135e1effb874f6a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764672142, "uuid": "2890b3d3-4229-44ea-b55c-854edfaf91db", "comment": "Malware payload (Mirai)", "value": "d2c9242b912204f3843283727021d0a0051d3d8af3e3a1ed412b35d39cea0987", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764672142, "uuid": "f880901a-2dcd-4512-89e2-d0e0859a60f8", "comment": "Malware payload (Mirai)", "value": "2da1da8bbfa9ff803265885e154e2b98ae7eb0d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764672142, "uuid": "002f6f5a-403f-49e1-b503-c707536acdc7", "comment": "Malware payload (Mirai)", "value": "e3a0e4bd81bd0185b5369051fee53499412cfa8700320569b3e382b3fda37a9b795945076763d79d09b8004e91206d33", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764672142, "uuid": "7cf1d148-ecb5-4fc2-80c6-d6c1ea62fef9", "value": "T157F33C46F8828A21C5C713BAFA6D118E332217B8E3DF72129E205F6577CB51B0E77985", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764672142, "uuid": "e7066880-9bff-49a7-b01b-6bd9f876bf87", "value": "3072:OHVM2F21XAgR9rdKntRWqoJa+WGoulX2MdqHUZz:OHVM2M1XAgrde7l0aGvX/YHUZz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764672142, "uuid": "07c8c7bf-48a6-4f58-9a7d-842b3b6c494e", "value": 165532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764672142, "uuid": "06a4902d-1172-4261-bea5-d0262a39b25a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764672142, "uuid": "191f3df4-4e60-4d06-8538-2c45d32809f9", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68c8c750-cfaf-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1764701273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764701273, "uuid": "178731da-7df3-4413-987e-c79a2140e78d", "comment": "Malware payload (CoinMiner)", "value": "119c34666a1e091619ebd1c5e2e78aa8", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764701273, "uuid": "e0ea71c5-add8-430c-8e70-4bb8d348b99f", "comment": "Malware payload (CoinMiner)", "value": "d335a352595cd376587cc3e071b6fdaa58b1e8f5e193f090d679e36cda054b66", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764701273, "uuid": "57ec5a46-5cd0-410d-991c-fd65eb0d12ff", "comment": "Malware payload (CoinMiner)", "value": "3223708d3af42297834e430517d0565f6ddcf71e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764701273, "uuid": "41d70392-a40e-47e9-8349-d171e9e07402", "comment": "Malware payload (CoinMiner)", "value": "38cc4f84ee676cc3c9451672cd3f26bfeb9fd0246feb02200d4c1831920f4d8b717d47fcd62825f3d76b48684453b8c6", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764701273, "uuid": "0d9ab013-1b6f-4352-8833-b8ae0c01a147", "value": "T119F533485C5120F9E67ADABCDAEF2F686943367517217CEF10BA0BA40E413C5AB33917", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764701273, "uuid": "5a954a79-1091-4b5c-ad4b-e654245c67ad", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764701273, "uuid": "7b5748e9-4189-4f9b-9a4e-43c65692fc58", "value": "49152:MQwzyJiwcZn3Wkxob8qBXpyXw7pngnXP+4uyLd5Fiwzzi3uoCJxCJc3:MQD1cZ368qBsXmsig+eoCJxCJ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764701273, "uuid": "ac755202-2049-4155-805c-8dfc7434e584", "value": 3436344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764701273, "uuid": "f183e7f1-0f40-4ae5-ac5b-7da885ad53a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764701273, "uuid": "d174b51e-813c-4d12-96ea-0c3ae87033cf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d33b3d81-cf9f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764694579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764694579, "uuid": "c6585b32-5ccd-46eb-a1e8-ee156b9a09ea", "comment": "Malware payload (Mirai)", "value": "c9ef00113786532e9dddb7a411857c96", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764694579, "uuid": "528c936e-f704-4c2b-b667-635d240f1823", "comment": "Malware payload (Mirai)", "value": "d4de915f1cd6100a6f97a96305ef79e7c55ca34d4f61cce51925f3ef08c6bfba", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764694579, "uuid": "3d0838d7-63de-4765-b1f8-949b9a5b06da", "comment": "Malware payload (Mirai)", "value": "22837f624be1af6b51fcf49090c56ed2013f69a4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764694579, "uuid": "9caa2ddb-44a0-445c-a255-d18d4f1db892", "comment": "Malware payload (Mirai)", "value": "5a8624bbb5cedc3007f843299b22a0b2c7908e701d6cf8c16495b0f4c9c7aa3e561129ed5d312d861b17eaea3fa57fd5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764694579, "uuid": "ad748604-d168-4218-829a-3c74c8d6a798", "value": "T1615165C6B3D24A30FFB15EAA79F68054B080E09567D3DE86E0FCA4BD4D4EF095490B96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764694579, "uuid": "561c4b54-2663-42bd-9265-b54e2a8894a1", "value": "48:vXB+BYBOB0BUpzEB7BgBVBSBKBYqUfBLB+O:vXB+BYBOB0B0EB7BgBVBSBKBYqUfBLBN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764694579, "uuid": "00c841c8-9e7e-41fc-b077-7e288f0c140d", "value": 2877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764694579, "uuid": "7bdde417-f91a-4a7d-ba52-1cc293e947d7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764694579, "uuid": "0c09b64d-510d-4eed-b01b-674aed6ff1ae", "value": "thinkphp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cf98f1f-cf6a-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1764671483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764671483, "uuid": "cf0bf170-acd4-466d-8c2b-2677c1a55072", "comment": "Malware payload (ValleyRAT)", "value": "fc9bad695d924437065c5bd043ef9efb", "object_relation": "md5", "Tag": [ { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764671483, "uuid": "10a8d629-1b7a-4206-ba55-5ebd1c62e9a0", "comment": "Malware payload (ValleyRAT)", "value": "d5814ab7c0729b321519cd1c6a935c3f12d5bdbddabe999761e566f268e63474", "object_relation": "sha256", "Tag": [ { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764671483, "uuid": "45f3027b-3801-41a6-ab0e-595c6fed4eb2", "comment": "Malware payload (ValleyRAT)", "value": "7ac1da0da0c40980e3f17e5e8030ece0dc3f2f38", "object_relation": "sha1", "Tag": [ { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764671483, "uuid": "211caf9a-ce49-44f6-8e3d-057bef36db1a", "comment": "Malware payload (ValleyRAT)", "value": "e1986d1f1490fcaacba08b77eb52074f4d9c327f5cdcfc04f3bb979cb300dd51d445f60027f4a9d01d6f8f22b87ca5b3", "object_relation": "sha3-384", "Tag": [ { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764671483, "uuid": "921b0aad-3d60-462c-8159-9dd5fef9edcc", "value": "T1E29423A822D8AC156D50ADEDAD18CB796FBC861B067A9F4E4308D10FD437C3846E5F72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764671483, "uuid": "f60f26e8-313b-4d27-88b6-36c56968038c", "value": "12288:u89yk7BgQidDGE/46f1MPwhwVRW6MkdL8VA:u87VglgKCPWwVRh8VA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764671483, "uuid": "8576a7f0-0da0-4422-b1c6-6550651eecb2", "value": 424220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764671483, "uuid": "650a6dca-80c9-4eaf-938e-ce69b113149b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764671483, "uuid": "b60125fa-cd8b-46b6-91ed-c43ae34f5415", "value": "November Statement.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "959e411c-cf71-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764674719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764674719, "uuid": "2cf8d8cd-601f-4d00-87a4-d71d378f703f", "comment": "Malware payload", "value": "adc0c0b3ca526abbb314cddccc298790", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764674719, "uuid": "a276a18c-9e5b-4037-a0a8-38c95494493a", "comment": "Malware payload", "value": "d64c7e80267b4f7e8aba2865f0661b534415fd3b7e9a4ec9fc48f3f6a0b81596", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764674719, "uuid": "eaeb22be-2b82-4a7a-830e-b62aa6211394", "comment": "Malware payload", "value": "4805e7ca1c0d7c806b6feb9a401f1fe091362fb9", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764674719, "uuid": "c9565de4-59e2-445b-9137-4fa2b512bcb4", "comment": "Malware payload", "value": "17bf6be6f75889fbd01416926789b6eab8bb2c9fc172c77a00ba095ffcad3d488094177b2378515110263419790cca5c", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764674719, "uuid": "9b46455c-3b0d-4e29-a935-29d913f1ecd1", "value": "T1C631F3677F221379BDB4E660A1568223FD0213A75A592D7470EF1018A7174CA287DA2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764674719, "uuid": "a9d985d7-9a13-4835-84de-e6773fcf96a3", "value": "24:hqmEtcozCMltReUCQDsLzv/c1A5ALVsLM8GAyFGw/NhhddwN3FhpSoJ6nKg:hqtzCMltIU4HLALzJNjGo6y1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764674719, "uuid": "88de4c5b-c00f-48d1-9e65-b611a25a07c8", "value": 1787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764674719, "uuid": "8043478f-cf06-4847-bed4-86ef9d4a9907", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764674719, "uuid": "30cc5fcf-1311-4577-acc2-64fd12fafab5", "value": "miner.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b30bcb8-cf94-11f0-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1764689654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689654, "uuid": "bb13ff16-d065-4384-afbf-5821c5a6ff2d", "comment": "Malware payload (Joker)", "value": "2eddab107c318dc1ddc09c19b227ff4c", "object_relation": "md5", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689654, "uuid": "3c7c0800-5d52-4118-bebf-8ce7b8daa061", "comment": "Malware payload (Joker)", "value": "d6ee1b4871220c39b086fd2192b27299536d155577e9cb0a0acb164277941df8", "object_relation": "sha256", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689654, "uuid": "e9714c0b-27a1-447c-ba40-93023fb4d067", "comment": "Malware payload (Joker)", "value": "ab19a340112c95d35c769ccfebb354879874dbe6", "object_relation": "sha1", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689654, "uuid": "592743df-a8cc-4898-9f6d-66efcb179716", "comment": "Malware payload (Joker)", "value": "dde16dc80ba1fd1143b9a81c803c36a62254efcda223cf911df8ff252cb73a46150c28b8b3e8f99df9f40ff71bf1d46b", "object_relation": "sha3-384", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689654, "uuid": "2af9e742-6db1-4e4c-8803-15355a92aeb4", "value": "T12A08024EFA1CDA37C9E9A139889B076273217CA44AD2C3571605B21CBDB36EC4F16BD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689654, "uuid": "62c42e6f-2886-4b80-b5d2-032fbdfdc066", "value": "1572864:c+A/7uphNMaY3K7Lprc4hY8R4gqfL6xEGAzYgUhLpuvO8OgB3w:PA/SH6B67to4higmL6x/6UhLpuvlA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764689654, "uuid": "1889bb1b-39e2-47e8-8e18-baf463c48f7e", "value": 84561297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764689654, "uuid": "e2521eb5-183d-421f-8427-090a5215d6bc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689654, "uuid": "8d083d78-26a3-42b5-ac50-23c70bd7760a", "value": "Sweet+HD+Camera_5.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "564f059b-cf90-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1764687927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764687927, "uuid": "4379f8fe-d8f0-4a34-be4b-5a62beed4807", "comment": "Malware payload (RemcosRAT)", "value": "52b74b190ea3545767c2d4e5b77b8bfc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764687927, "uuid": "8745f8ba-cda9-40f5-86b8-d861bd0b842c", "comment": "Malware payload (RemcosRAT)", "value": "d7f6af5b758298f74943cc408fd2bb31d825bc94d54f7f376a73493ad330ff8d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764687927, "uuid": "7ecc0743-3d8f-46bc-b714-3ae41a478cf2", "comment": "Malware payload (RemcosRAT)", "value": "35862a39e1eca7f2fb8cb991645f25638de8a9cd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764687927, "uuid": "616313e6-915e-420b-9665-3a29b770cec6", "comment": "Malware payload (RemcosRAT)", "value": "7804bd619881e8570a8bd1f5cad4767c5bda868af2642b86db670fd8e208c1e08f230778329155ac1f95ad6bcb955556", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764687927, "uuid": "a4668f5c-cabf-41bf-bd49-156441e0390d", "value": "T1FF66951527E00447D2F6EEB4DE2D6DE0AD0E3D1B64C58C5A752978AA306F88CB960D3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764687927, "uuid": "038b740e-3e7b-44f9-bc40-e9eb051ac1d3", "value": "49152:aHrm4N5uzwtqXO564uh07zKFjz7gx+o1Utoz1WDyyOmGm0Tc1UZtGIac:nz8qXG687zKpz7gx+oUWzoCm0TcoGIac", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764687927, "uuid": "02e3deb0-fce0-4caa-bd1d-ab3803237d2d", "value": 6562633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764687927, "uuid": "aa335945-1c88-4ea9-b90a-2d82189c53e7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764687927, "uuid": "bb102988-cdcb-4f9e-936e-f117981043d5", "value": "CONFIRMARE_PLATA_TRANZACIE_FINALIZATA_810005310.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d96bdc9-cf58-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1764663915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764663915, "uuid": "4d975615-205c-4a54-8b63-54128f199998", "comment": "Malware payload (AgentTesla)", "value": "b5fc0f9e65fd9ef2b73907042e9f7ab7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764663915, "uuid": "6c1353f1-3d3a-49a3-b592-f50fd4ae5f3d", "comment": "Malware payload (AgentTesla)", "value": "d802fd1783aa2edbecaa36a9ae69b352edb42a595ce55cecab5bd30961ef5d7d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764663915, "uuid": "f43ff17e-1d34-4149-b862-fd3332fc5163", "comment": "Malware payload (AgentTesla)", "value": "7eea9fcf594982dc9db242fae4ee50a40098729c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764663915, "uuid": "38a2b886-62f4-4fcd-ba1b-a6ea22f0564d", "comment": "Malware payload (AgentTesla)", "value": "4b20ab1b26401bf4a0af3d349c3fb05fcf63b4945a1ff0011863ea253341aedde744ff806cd022503b971c17fb0ca50b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764663915, "uuid": "a967790b-4411-47da-8d70-0ab13094ada2", "value": "T1AA45F1115EC42FB9CFA8591880FE161E93E05A8F441B754AFB3BBD4AAFF7644420B1C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764663915, "uuid": "eebbc9ee-285e-4586-8eca-384e71276ad4", "value": "24576:Htp29ej66ar10GGO6a0g/Ws6uDlNAkVdz+9/yK5:QdP6uBNvz+Fh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764663915, "uuid": "2ffd9364-2f90-41bb-b9aa-6080cf95d905", "value": 1220600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764663915, "uuid": "e7dd0b17-3bd6-417e-8079-558db6f13418", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764663915, "uuid": "9403ab6e-b381-48a3-8f9c-612627d2b74e", "value": "DSV SWB Sea Waybill - RAF0049122.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f4d457f-cf2f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764646254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646254, "uuid": "7bb1b868-99fc-44b8-9046-6c43d0a15534", "comment": "Malware payload (Mirai)", "value": "b9e29f7bafc875281b4c277932dfde0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646254, "uuid": "8045136a-94cc-43f1-ac14-24b88f488284", "comment": "Malware payload (Mirai)", "value": "d8865806a0881fb26fdba3b622174672af548a9645d1308d4f042da0e55300cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646254, "uuid": "8a3c7873-d783-46c1-b01e-dcb99bbaf50d", "comment": "Malware payload (Mirai)", "value": "565f94a3156f4e0d36d40caa469fc59066ddccb4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646254, "uuid": "26233441-8e0a-450b-8df4-dc3aa62b08df", "comment": "Malware payload (Mirai)", "value": "1bc75ca31a3746afbd5e839e0caf2750cf1c3f13da8a172cb6b8042dc1ec94f644e048a05a5614c3a2d6d7de554f0d68", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646254, "uuid": "d860d9c7-be5c-470c-92e1-4d2853ed6fcf", "value": "T1B4534D96B401ED3CFC5BE6BA40161A19FA213B3015A30F2BA797FC939C721B6DD16D41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646254, "uuid": "0e8be0bd-fb1b-45b9-bbfa-395f7b6c303b", "value": "768:reT+6JhUvtNaEVGgb2x9+FizRN1ul8yXLyCYlqXxZv2XWFql:rInQvtNFGgbejlNUl8yXxGqPvyFl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764646254, "uuid": "5181efa2-dd00-4582-ad52-2c4676033cac", "value": 61432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764646254, "uuid": "cb528d1a-72df-4022-92c8-97c48fae4657", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646254, "uuid": "43c5bd8c-8970-48b1-94ab-658da4b7a69f", "value": "jew.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "209ccc83-cf1d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764638445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764638445, "uuid": "f21d44e6-4b6f-40e9-b1b3-8d59a9b3e3f5", "comment": "Malware payload", "value": "955830759a077b412919d37b6dca9024", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764638445, "uuid": "1a71ffa8-7437-4431-b048-e061b4942117", "comment": "Malware payload", "value": "d90886115f8ead39f4522ca7e158515e26b4d34485653f879954c230da8d072a", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764638445, "uuid": "1956000e-b35e-44a8-8006-4f2857d2a0ce", "comment": "Malware payload", "value": "45705a4326cf26c7e95a792ec87b99437611c060", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764638445, "uuid": "a57af358-9dfc-4dcc-8f0e-497c24e9754c", "comment": "Malware payload", "value": "8aca90df5345e6aa33e3c08070511940ef67be1d3984738a0f5041062d6137fc9084103227faee38be8ee7c1123f62aa", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764638445, "uuid": "017fa4ba-2615-492c-9861-cd1d160c81c5", "value": "T19273556C1EDB80FC9627B49489DF8C06E3E48917261CCBED7A5DE9B03F1542862F86D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764638445, "uuid": "a4ae19b3-5519-493f-877b-4d678da57cc1", "value": "768:0DmdlUTXFR7yHNHb1xsOGyG7I82gwpptn1+C1+npyAaYcZFJHFAbLC1k8mMrPVSm:bgXXytEWHX+C1+pyAgHSF9T87N/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764638445, "uuid": "c21ebda7-a3a9-4833-9670-6a4772a37a85", "value": 76045, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764638445, "uuid": "5390fc85-7702-4780-aa5b-77603ab86526", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764638445, "uuid": "187efd35-b756-4189-8100-40ad3c68b38c", "value": "1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca053146-cf3c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764652044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764652044, "uuid": "53ba30a9-f6e4-44dd-adf5-f53542b07f6b", "comment": "Malware payload (Mirai)", "value": "a8c399ec619cbeca581b079608fe197a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764652044, "uuid": "e66a570f-8482-459b-a481-d4d5ed504fc8", "comment": "Malware payload (Mirai)", "value": "d957db2ea9981d4ea17461b7901cf87482c4590ee764665b94a5994233c2c3c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764652044, "uuid": "b72d594a-1875-4c26-8ce1-5d7fcf86d217", "comment": "Malware payload (Mirai)", "value": "6905c1b1041613935e47f2c908e0c13d9da3666a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764652044, "uuid": "143077a5-b2ec-4b29-acca-3b98ba5a6b13", "comment": "Malware payload (Mirai)", "value": "060352ad1ced91c9ed3458f9dc89ce28f4f3294052ae7de9e342636f688e370702f5828ed80d32af31b189c00aecd85c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764652044, "uuid": "39ffe50f-eb4e-47a0-8bc6-e78820ac6453", "value": "T13DD38D68FE4FA8D1C2C7E37DED4A0FA275177874D655C0B10A40929FD9EAEE88890217", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764652044, "uuid": "7a89beb4-9fec-4dd3-a9c9-2154179744df", "value": "3072:PLzwn9pxfQ8PjUhAjdmHaesQbC+KPqKNQzPxm:PL4j1UhAjdmHPy+K0bw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764652044, "uuid": "d1d629c2-c51f-4fbb-8203-8157b65a9c76", "value": 132048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764652044, "uuid": "ef87f999-5a73-4d18-86e7-9aa297d289f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764652044, "uuid": "5b7af511-4a16-4057-8dc9-2082de8d0321", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63f967c8-cfbc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764706848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764706848, "uuid": "2d50069c-bae5-4117-9e99-69098bbcbc21", "comment": "Malware payload (Mirai)", "value": "fb0ad9996e539e1ded6379a9423b2f43", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764706848, "uuid": "6565d2c8-c19e-4c4a-b250-221a3d09c44a", "comment": "Malware payload (Mirai)", "value": "da054e550b8d19edb0e7e31051f1c0c6b3c8d390a65d2b6f5e95373c895f1866", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764706848, "uuid": "988d1485-4cc9-4585-81c1-e73a65099f1b", "comment": "Malware payload (Mirai)", "value": "16d1b47c443ec6bd723f3b86f308fbf27ed1520c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764706848, "uuid": "f303ebc7-bfe8-4e87-971c-3901e6d98724", "comment": "Malware payload (Mirai)", "value": "2c27533be0859c06df9aee861439ad62f081bb286cf07b19f269a185f1dab4d54e2f01090a29346f8635334c8aa03723", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764706848, "uuid": "51ea4cf4-ef71-48ff-8a44-a277507bceaf", "value": "T1BE03F682AC92855689D813BEF93D41CE3312B3B9D2DF7152CD015F18B6CA94F0DB7A92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764706848, "uuid": "135fd2cf-f2f9-42c1-93c5-18a5790642ea", "value": "768:CMn1EjZA//+1vTRfRiOC7wYqT4JqsWA3B5d7I9ybMioW+j/LsYtXO0CF:CMn12A//SrRftY97WARbIcbboW+zLsYk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764706848, "uuid": "882ed112-4102-4704-872c-d2ab47bbd650", "value": 41040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764706848, "uuid": "9d3bcec9-0e7b-4076-a536-0024ae865f6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764706848, "uuid": "272f11f5-9b67-4a91-a11d-70a5a934f5c5", "value": "SecuriteInfo.com.Linux.Mirai.4873.13951.357", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52cfac6d-cf13-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764634234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764634234, "uuid": "4c1d349a-7912-413d-a02a-7fe64aa2f410", "comment": "Malware payload (Mirai)", "value": "157386b5e07a295571d7e46edb7c6122", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764634234, "uuid": "e05749ea-f80d-4fc0-b1d5-61e6e7b2bfb3", "comment": "Malware payload (Mirai)", "value": "da2977cb3d0369afc113d77d09e96d4b1f423c695fc655df203df15b60224f9c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764634234, "uuid": "b4c223fb-bf42-4661-9e52-20f3185fe9e7", "comment": "Malware payload (Mirai)", "value": "5a61f5e468e5fd7e4af1ee0199a9609f94a9567b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764634234, "uuid": "f5fb7ef6-6ce8-4b4d-ad8a-ed8973398649", "comment": "Malware payload (Mirai)", "value": "8afbe49ee8e6e35a6147eea93a1598e619c81cc0e8d9937b9d5d5f51c1a2e923536da6bf4d28a8afc691b92e18387520", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764634234, "uuid": "5e508232-4bcd-44f6-8b72-55bc18466f69", "value": "T146A36DC6E5D3D8FEFC1605312176AB37ADB6E27F2278CA82C3A99531A822410D51776C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764634234, "uuid": "64dc84d4-a97d-476e-9ea4-073bfd456db2", "value": "1536:g72oXkQcSKx42dRynru9s5Ne+/dw3+nubpQTOSkuzw:g7aQcRx42au+5U+lwuubwz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764634234, "uuid": "0ad7652d-7960-49e4-9d69-b0d241657e53", "value": 99668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764634234, "uuid": "c6dec88c-d6d1-42d1-a586-d49aea8ee26e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764634234, "uuid": "c793ea35-ead6-4b01-a76c-de822214cc9c", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0216b674-cf7a-11f0-a129-42010a9c0007", "comment": "Malware payload (MassLogger)", "timestamp": 1764678337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764678337, "uuid": "82005af2-472e-4725-913e-d0c39cfae698", "comment": "Malware payload (MassLogger)", "value": "36a0d42f12d6c262cd3ce83e7781c689", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764678337, "uuid": "dc3bc854-6d0e-4441-a961-2e3c22e4659e", "comment": "Malware payload (MassLogger)", "value": "db27519748a4ad7c5b19021ff6d05ebb6b9fc66b9c8b236a5d1ffe17f97902a6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764678337, "uuid": "4a181a65-ba4a-4b5f-8fa5-d879e919dc65", "comment": "Malware payload (MassLogger)", "value": "20de42580d661220ef4711d3e5db666af4d4e2e8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764678337, "uuid": "a8b574bb-af81-4cb1-aad5-8c0279700f1b", "comment": "Malware payload (MassLogger)", "value": "4ef7d357589a81bf6eaed79145f32c1d422383d624012668e298f90fda6f321519d6ca0148ee8882a006234b08ad875c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764678337, "uuid": "d13c852b-a2df-46ee-8b13-8e1d8c1b59be", "value": "T17504309067D07C982B8B1B7BB62FF9D1E87F08ED3484444BC516BD90716470AF9E1AB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764678337, "uuid": "34e4abfb-4320-4faf-a1a7-506306028769", "value": "3072:drRfwO0NHWQkM2pIK/H0F+/kcLQmHOtto4q0/fgjzgW5XaMSlZioo5GplRYAY0Y7:t5XpX3AiybNy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764678337, "uuid": "6121e867-af9d-47a8-a689-22a7406a58a2", "value": 173659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764678337, "uuid": "133c09b0-7c9b-4f25-a177-aa89622b1b92", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764678337, "uuid": "3d53a0cc-4dad-4c74-8ceb-ae90ffe59e04", "value": "F\u0130YAT L\u0130STES\u0130 VE TEKL\u0130F \u0130STE\u011e\u0130 - T\u00dcB\u0130TAK-SAGE PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ee4544f-cf25-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764642066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764642066, "uuid": "4a67008a-7d1f-4e9e-8a4a-cc2f94a91546", "comment": "Malware payload (Gafgyt)", "value": "ba7b881c7ac35178ed388ae9998df95b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764642066, "uuid": "b4838881-e98d-47c0-b94b-eefea33b744d", "comment": "Malware payload (Gafgyt)", "value": "dba0bdc3cdf35631655f32cbf342f3e3b133f6309f89d956899a740b90a43ddb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764642066, "uuid": "8686548a-8a24-493f-9931-5c2b2aadecfe", "comment": "Malware payload (Gafgyt)", "value": "89de433f8b1805c1ba7b2fe550f24491f3ea6e19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764642066, "uuid": "8522e7d6-70ec-43f2-9346-5b1aafbe6859", "comment": "Malware payload (Gafgyt)", "value": "a3a789c039a506a3cab86eba80d4d467d0142dcebd6aa46dac4732873ee3251976fb572645db1db25c7a60d6417b5a5c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764642066, "uuid": "ee6a4ce4-01c9-46ec-a268-1798496b6a54", "value": "T1F3329339D11BC0F5CD1A26B2118BF5EE6534371898321E9FBB9A1D10F73EC60A6406AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764642066, "uuid": "89caffae-4ebd-4424-ae75-7cd933b418ee", "value": "192:fdeAW4c46mUkH6C/yoKuQFi4nU3WOEVAc/pFjTxHzMan0oBM7xR:fAYvUAaA3UJLTxHzjlBeR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764642066, "uuid": "60bd58d3-a9a6-46bd-8f43-9824834d88a9", "value": 11376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764642066, "uuid": "0e5643ee-e6ae-40ee-9461-c543a0c44890", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764642066, "uuid": "59811e52-95d0-4260-bbc2-cd92407afb83", "value": "SecuriteInfo.com.Application.Generic.4216895.15754.19656", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5ef334b-cf14-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764634938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764634938, "uuid": "e1f157fd-1543-4618-9799-42e42bfb476c", "comment": "Malware payload (Mirai)", "value": "6d166d2f8635b5d36c491e61d8500057", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764634938, "uuid": "410c7954-867c-4899-8f22-fcb861f0dd82", "comment": "Malware payload (Mirai)", "value": "dbd24a4ac764a6dadfcb41063eb13e4a498fce49c33d493d958c9f558efb5fa1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764634938, "uuid": "faa11706-6d47-4db8-89ce-f69436ed2668", "comment": "Malware payload (Mirai)", "value": "8613704b0c180ebc29f320cffd74b37530f7e6c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764634938, "uuid": "c96d5f8b-f0ea-453d-a685-891f7e56df3c", "comment": "Malware payload (Mirai)", "value": "80bf7e0cf9b40306289806faefec1b5aa7675c9eb59297d36652009d3c6c5384dc78a18954e56330f52fda36fd47a4f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764634938, "uuid": "f7823aa1-4c99-466f-ac34-614dce140724", "value": "T13203F117E1EDA551C16B033468CB2A5744C1A153A9A6D6BCEBD086337E19B0ABC3C3F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764634938, "uuid": "8da16ea7-000e-4881-bf2a-5748172eb3e5", "value": "768:oekk5aAo4WpKNhX9odnZjjt1z981qUZO5Idlc8nBGrnx1nbcuyD7UHQRj7:oekkNotyhX9qlp9oHm8gnrnouy8HyX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764634938, "uuid": "7899e00f-94b2-47c2-87ad-47aeae419ece", "value": 41072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764634938, "uuid": "9b9d954d-d6d4-471c-87ad-ad493143f3a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764634938, "uuid": "9de5b1c3-40a5-4995-9531-2e165ec9e6b8", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f10f2e9-cf9d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764693472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764693472, "uuid": "91b36159-cf0f-42ae-acda-f22e0e9c2f75", "comment": "Malware payload (Mirai)", "value": "a732bf23c5ccdd4125e94cca5e697f74", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764693472, "uuid": "44d31d82-4f58-4b41-b9de-ab3696957288", "comment": "Malware payload (Mirai)", "value": "dc103627a4c9f0e187bb7acead5ce8e724f553d7f4eb034171ca2e5fd0b5f25b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764693472, "uuid": "58c4d07e-93e7-4f24-a1b0-e60a52488c99", "comment": "Malware payload (Mirai)", "value": "250a6bc858f3acbee4ce6ed0bbe901e29176b8e1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764693472, "uuid": "cdb89409-e358-4e39-83a1-9f3f9759275d", "comment": "Malware payload (Mirai)", "value": "1a6b55cd43e5ce83b7910f4505ac3f594f4f66545f9c212ea29a4616d90572a49364cb6e28c22bcc72390761cbab3e62", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764693472, "uuid": "ae4a1392-7047-42f3-bd9e-337d58402deb", "value": "T1655161C6B3D64A30EFB15DAA75F640147084E09667C3DE86E0FCE4BD498EF0D9490A97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764693472, "uuid": "ee0a2103-1d01-4811-9ac6-83c321ba0d1b", "value": "48:vXQgi4+Qgi4YQgi4OQgi40Qgi4UpzEQgi47Qgi4gQgi4VQgi4SQgi4KQgi4YqUfZ:vXvi4+vi4Yvi4Ovi40vi40Evi47vi4gu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764693472, "uuid": "a90cf7ef-3d0b-4712-988c-fa97c6d92a64", "value": 2863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764693472, "uuid": "2fc72fd4-e769-47d3-9127-71d259e47c44", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764693472, "uuid": "05f87270-0ecb-4769-b0d8-c92ebd3a6a96", "value": "realtek", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48e40778-cf2f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764646244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646244, "uuid": "d4bf21ac-9919-45ee-8cb6-36d1eadd1c66", "comment": "Malware payload (Mirai)", "value": "e616ccb97b2958046f5b0d1c789fbf2f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646244, "uuid": "b29dbc58-6762-408c-9257-54c87868cabb", "comment": "Malware payload (Mirai)", "value": "dd7d3339ce462c1964be9d2823e204617de086fba10a5452c94c50450b1c8213", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646244, "uuid": "971921db-8abf-4a87-a38f-677cc27119cd", "comment": "Malware payload (Mirai)", "value": "3d8529ab35b4cba91116909e3cdee2ac73109fd6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646244, "uuid": "5e4e232c-a329-4b60-b07d-52b9dce926f5", "comment": "Malware payload (Mirai)", "value": "e1a8a954d482779e7b96a833e33179c66ba5120184f4de09998d260316517f20eb6bebfda79fa1f63ac584721e8f8aba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646244, "uuid": "25bce1a5-cc72-4f86-9096-1c7fbef04a08", "value": "T172438E36C47FADA8C5858638A42149741F63F50882A7AFFA9BC587645047FFCF6083E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646244, "uuid": "85e75323-e2fb-4fb6-b711-78769d2b897d", "value": "1536:rHdIcHE2ZwtdW4KWjUKbq9V9R3qLw2h5CwSd42+:rHFHE2Znnz9ZqLw2h5Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764646244, "uuid": "3b7cf125-e15f-40b6-9b7a-ec879a904b02", "value": 55212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764646244, "uuid": "b25e144f-d17b-4d0a-866b-5177ba45a983", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646244, "uuid": "6ca18fb5-2887-40f4-8e63-b608a4662515", "value": "jew.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58517cd2-cf71-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1764674616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764674616, "uuid": "486a6040-a722-481c-a81c-7cbae70106d3", "comment": "Malware payload (CoinMiner)", "value": "34fc3ebfbdad0feaa45daf195d40a470", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764674616, "uuid": "08d0574c-0b36-4c23-ab1e-5a22e5b4eb3b", "comment": "Malware payload (CoinMiner)", "value": "de3f249216c36e87df417d2893cb02bcd99937a8e7e7f1942ca5089128807c73", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764674616, "uuid": "ad519267-48df-4446-905b-d3c926b9d5b0", "comment": "Malware payload (CoinMiner)", "value": "a3186eb5b7dec9afd47ef13c4cfc6892e27848c6", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764674616, "uuid": "28a7fb28-dbd6-451f-8245-6976b8226898", "comment": "Malware payload (CoinMiner)", "value": "958bf586d61cb8d29794d2550f843cff145817b2cdab0fa58ce94e70eaaf832ee36f0900bb5bf5880397b4ff8acc75ae", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764674616, "uuid": "63015ccf-bd97-456c-aff7-d494c1e22483", "value": "T1B802EB1649026236C6B1432656C9F3D5FE8F107EB6091C29F019A85437B4C4F8EBADAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764674616, "uuid": "da656301-b564-449c-b1e1-069efd4de805", "value": "192:4/2Ek0UQKL0IpQYEenYrxhoxelD/xMv+l9ZJ8gk6UXNSdDcrig:4OEkRIIpQYEP0etJMv+l9ZzkGD+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764674616, "uuid": "442d5ac8-c6e4-495c-a504-3119fd0d0433", "value": 8756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764674616, "uuid": "c0d2ec32-dbbb-4d9c-a58c-d4464c8f34c1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764674616, "uuid": "a12b6f5a-f964-42fd-8c40-3fb80f0cec4a", "value": "Win12 Setup.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5968186d-cf55-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764662592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764662592, "uuid": "26e4bdb5-d297-4ad8-af25-6a53d562dd4d", "comment": "Malware payload", "value": "b0c499a5d09753feefce74da0f1d58fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764662592, "uuid": "103e4050-fb14-4fc6-aa51-06271a936cf1", "comment": "Malware payload", "value": "dec24a14f83ed2a0c6fdb82fc2e3e08ee48fc0b3c2d2ddef2cdb4450c9930202", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764662592, "uuid": "07a6a585-360b-403f-814b-c8ac864df849", "comment": "Malware payload", "value": "617c17f2b0c741106d2597ca8b848792c0d4bae9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764662592, "uuid": "4c4a6f20-aaf5-4229-b03b-4bb59db57dd3", "comment": "Malware payload", "value": "b8f7d1ed18d1dcd85d496958eb3d14b52b456fff732e5022e3f1acf8d5775c55ecbf88025c3427ba2f01cab80f6e958c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764662592, "uuid": "925a14c4-16e3-4217-8270-17a1a54bc6e7", "value": "T1DA25228143A8D803D4532FB069B1C1B07738BEDCDE61E74BEFC92EEBB46E6185549216", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764662592, "uuid": "8995b01d-4d1c-44b2-995f-3a6f0919173d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764662592, "uuid": "f372dd81-5867-4aad-ab37-fa1e14ba3d1e", "value": "24576:299NW1AZUjW/A6NDui+vpGdCwGzTRZqpGiF8fWS7:2/N8SLNqw4pnRZq7F6WC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764662592, "uuid": "5d1483c1-86c3-4d9f-9751-16a84c4efa29", "value": 974336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764662592, "uuid": "5158a8a7-233b-4e43-8551-0b4b65fc37ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764662592, "uuid": "1537d1d2-a532-4bd1-b569-746a362266f3", "value": "DHL Original Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a9db502-cf6b-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764672097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764672097, "uuid": "cb8708f2-f4c4-442a-a2e5-4da153721d60", "comment": "Malware payload (Gafgyt)", "value": "3abeb8fbaa63d6ddf4052bff8411609e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764672097, "uuid": "da9eed0c-7db7-40f1-9136-7610c9bc6fd4", "comment": "Malware payload (Gafgyt)", "value": "df13b734986424228b2d91c97d64c78429366f6d9572c2a675ee49fb1954b44b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764672097, "uuid": "0b56082f-8662-4933-9b12-48558bbec9cc", "comment": "Malware payload (Gafgyt)", "value": "5234570ca6c18f583fc85fc5dd069f2c43f6959e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764672097, "uuid": "ba21b2ba-b389-4086-a562-acc7db01b519", "comment": "Malware payload (Gafgyt)", "value": "6eed4310f2bd7d672a382e6386946c965952cce44f6108909f99e47ecb96c24fc1006c77a1a5b200beb0ea7de672384d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764672097, "uuid": "6c3e7ca8-ea47-415e-b3c5-d816d4495112", "value": "T19453F905F950871FC6D277BBF75E039D373A5A58A79B33116A382EB03BC5BA42939120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764672097, "uuid": "d59adbe9-6aee-4f03-b666-a43f6431aa82", "value": "768:eWxHNAAkh60EofRDJFgSOhXFWUec2iRxElK0cENgpelBmS1/cd+MafSwKrAgDd:JHNg3P3FgSOh1MhiRx1ZxeRGAKj35", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764672097, "uuid": "7cac2b16-b3f2-488c-9034-95c882b0dc0c", "value": 63760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764672097, "uuid": "b0c6010d-71d6-4afd-9f56-25fd257d6f63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764672097, "uuid": "6ee5eb43-16ef-4dfe-aa07-e43900a91e6d", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f5967e7-cf3c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764651892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764651892, "uuid": "3338b3b0-5dc9-4c26-9c63-be805bad5436", "comment": "Malware payload (Mirai)", "value": "aa3dfc7df2f55a5a390dc4393c5246ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764651892, "uuid": "8caba5fc-2039-4e35-a568-b40c770e6095", "comment": "Malware payload (Mirai)", "value": "df5a37b800746e4ff44d408b4f90d92f5adb06045974df8450e97e2c218eb613", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764651892, "uuid": "513624a6-285f-426e-b8f4-dc88b43f9edd", "comment": "Malware payload (Mirai)", "value": "6b92f656af199464a716746deac48484bed8b35b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764651892, "uuid": "c1901866-a426-4e75-be05-f186adf31d76", "comment": "Malware payload (Mirai)", "value": "78e1f6ff5a024f657c267898c2d5f973c301b3d0d732f03503a69db9ce4056816e167f6d1fe70cd4b3f48f78209bdcf9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764651892, "uuid": "38548fe4-fbb8-40ad-ac5e-cbbb3840ed24", "value": "T1D9E31859FC80AB11D4D635BAFA4F024933535B68E3FEB112EE244B2127CAA1B0F76516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764651892, "uuid": "17cbcd5b-47ae-497a-b0c8-bb78ef90e32f", "value": "3072:oMkI7H0keivL2lOWkfDhTutyATEafY/P8Hg9K24Xoi8:t0kzDGMDhityUEafY/P8Omoi8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764651892, "uuid": "5191dc16-c0d8-4098-bc63-801b24b9ae9e", "value": 145252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764651892, "uuid": "28f28f9e-5a3c-4ef5-a888-3f8c480b865a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764651892, "uuid": "eb537f97-4c37-4e86-9c31-f87cf2f2d91f", "value": "gang.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1de69b4-cf37-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764649936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764649936, "uuid": "c02db6a3-ae99-41c4-abb8-0e6b983e89a1", "comment": "Malware payload (Mirai)", "value": "7bf74662b70ecfe29e5bef6195e1e898", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764649936, "uuid": "f53e0f1f-0fad-43fb-b1ad-ef0657a36efc", "comment": "Malware payload (Mirai)", "value": "df5c3a8b02a0627ed2f8d454a42eb27d7b04804960bf9e6f6eab6eff7c46a72a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764649936, "uuid": "ef3ebef7-c963-41e0-a213-eaf52b6bc74c", "comment": "Malware payload (Mirai)", "value": "0ba9181143e4f58f714c440cdb078190785114ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764649936, "uuid": "4aa5da46-cc90-4825-9a45-e92eb8809bf5", "comment": "Malware payload (Mirai)", "value": "48ef24695455f510217a286ee2f1309a8ca645a46e4d27fded4ca78933848cbb2ffd2365d92dccf994a5257f3fc61085", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764649936, "uuid": "2ab6c618-558f-4226-8417-4e15996044fe", "value": "T109C35B82EAA3E0F1E18701B01557F3E78934E5345126DDD6EFA83970EC71A825E9B72C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764649936, "uuid": "143e3e5c-d33e-4cd0-ba6d-8288f79bcfb4", "value": "1536:Xz+2oHjMZfaS0jDll3wZvZS3FsJ+XuypYor7wKRkRzrXEUg9dXW0Kr9iVCY9bgCW:DYHj1oRSCevtkKwIUAW0KrIVCrCwqu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764649936, "uuid": "800b8a09-e2da-471c-a40a-f1fd5c8d33a2", "value": 119484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764649936, "uuid": "7c59a64d-2847-41ee-ae02-fd74d94b7d4a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764649936, "uuid": "2e557634-b15c-401e-8163-057f8489406c", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e005703e-cf46-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764656376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764656376, "uuid": "bd3d653b-efc3-4b5c-beeb-6c219eecfd2f", "comment": "Malware payload (Mirai)", "value": "86cad2d87fd4207354b2823934894687", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764656376, "uuid": "302e40c0-c468-4dbc-aea9-1e302deb8527", "comment": "Malware payload (Mirai)", "value": "dfd20ee511aadc6621073c0f91715f0dd13d4b9caae457fc52a360359bd1ba56", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764656376, "uuid": "f0d682df-e062-4e07-b76a-cdbc3e3b2465", "comment": "Malware payload (Mirai)", "value": "372c636bc8eef5a8eeb388c5e803c6069a8e75fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764656376, "uuid": "3dc1f9d3-ee17-4d64-9c94-a11e0595b109", "comment": "Malware payload (Mirai)", "value": "9a8adb3b3bbffc4583bab5aca0afa52efcf5509f4931812080cf8a08388abf02fbb9179bb0548fe1777f5ce9cc281153", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764656376, "uuid": "ed674360-5487-4714-81a3-37e4f0075996", "value": "T156339E76C42EADD8C6458734B82A4A740FA3E10891E76EFA5B8586A54043FFCF61C3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764656376, "uuid": "02dd2430-b8da-4294-b4fb-4786d87a4e73", "value": "768:Er9Q6eGyC75erUUeOiwwtNp40Zdi/FyGoMuJLk3XCmlolN9aXCxK:EcdC753UlwtNEFyGoMD3X3qlGXCxK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764656376, "uuid": "5496d8fb-1fc4-4ff6-b125-58d3569854ac", "value": 51924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764656376, "uuid": "b781de41-cccf-4a84-b4f3-61d176af0f29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764656376, "uuid": "8d579f36-8308-496e-9ecb-3abe4e8e4980", "value": "jew.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9be5313d-cf5b-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1764665281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665281, "uuid": "9416ac6f-e29b-4851-85fa-ef67e7c9d0cc", "comment": "Malware payload (Formbook)", "value": "9a8a88ad4308cad8814369cb40e93bc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665281, "uuid": "c197f140-1464-41a0-90aa-7eac1e4c2f81", "comment": "Malware payload (Formbook)", "value": "e07e7df88008f8d1ba3b459a3e8907c78c7a22cadfcb2ab439ffda155d3e2fc0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665281, "uuid": "b0869206-d5c8-4028-8fc2-9fd84797ee7f", "comment": "Malware payload (Formbook)", "value": "5dc3539b6fed4f9905e5a6e29bf13909a7c6e1e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665281, "uuid": "af99bbd1-0043-4020-9ed8-78a95b626d99", "comment": "Malware payload (Formbook)", "value": "47ef041ba9115fc5b0d6d13faeb87dc931e38399782a2ed837d93de3e1f816a879bf8f8b7f52780eb76dee42f761ec24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665281, "uuid": "4c6cd490-0112-4b0f-acfe-7d209163a022", "value": "T1D505F08BF2C4E803C8425A743B61F6B4CDEE6DD9980ED697AFE83E5B3D795151A23001", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665281, "uuid": "78a8b9fe-bd81-4e2d-81a1-19eaa7712b5e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665281, "uuid": "bd5b633a-910b-4517-a3eb-d6b8d0344e90", "value": "12288:F0WbnbtCKNB1QoV2PEZ9Z9Y5RmPk+686QiHqK7rqmDFEUyfxUPm5UX50585QQ+:aYtzVS3Rq6QiH+mJyecUey1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764665281, "uuid": "3eb9ca2a-b97a-45bc-a1c5-b98290a5b9ce", "value": 837632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764665281, "uuid": "360e663e-c0d0-448a-a591-7592e0f81be7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665281, "uuid": "55263558-eec7-4483-abeb-7ca3d1b44391", "value": "Quotation.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4ab387e-cf90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764688059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764688059, "uuid": "7c8adbcc-a7ef-4252-a5ad-daeff194258f", "comment": "Malware payload (Mirai)", "value": "4c7f7d379c96b8ed4db772d7473444c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764688059, "uuid": "ab9f30b0-42a2-4581-aeb6-e4eb5d040501", "comment": "Malware payload (Mirai)", "value": "e0d6334dd93701bfaa34a824d7e334a5ad40ef087341d7f86471d5fea2a4cd40", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764688059, "uuid": "ec8f13bb-a2ed-4372-8d47-b3355edf33bb", "comment": "Malware payload (Mirai)", "value": "192b72069f566267c3acee83e9f35168e1c5b1e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764688059, "uuid": "1d8c5027-5280-4036-be9c-9ce729a38014", "comment": "Malware payload (Mirai)", "value": "4ca472a39079a074895fd7f18d948ad4b3c05709fc08c1b0f0cf14464f46a4783a6cd3553b08e05ad9c96501f78ced4c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764688059, "uuid": "3e29fffb-d7e3-4045-ae7c-944afebd9c17", "value": "T16BD3D569F6424B23C0D30775B5EE9E0A3F3197D163DBB3026A345BB03E9265B2D12D89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764688059, "uuid": "76a37cbf-2c5e-464e-98b2-5ab444d3545e", "value": "3072:XYfznIooLPcRGCERRJ55P3KLu9clM/9GTA5:XYfzIfLPcRGC8J59aLu9qM/9GTA5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764688059, "uuid": "e7a95882-9a08-4f22-8848-e6f9ec9d7f0c", "value": 142135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764688059, "uuid": "d4a68f72-db20-48b8-a0c5-a4baa8b60a20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764688059, "uuid": "f2afa703-8e2d-490a-98c6-a528ebf6f07d", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34491c8b-cf6e-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764673267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764673267, "uuid": "6b2b6ad1-7bab-475d-84f2-2a87bce8377a", "comment": "Malware payload (Gafgyt)", "value": "29d69bf0029e806543c4492421c44d41", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764673267, "uuid": "6da4a035-409c-42a5-879c-abff1ac6a162", "comment": "Malware payload (Gafgyt)", "value": "e0dcdcb09c8274137d4779c969137af3c4fc1ea08ba60afe1eafcc644d4e69e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764673267, "uuid": "351a178f-d138-4264-837d-d96ffcd8c48e", "comment": "Malware payload (Gafgyt)", "value": "7a17039f53354f245d6cc53981414bc78d330ba5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764673267, "uuid": "323d84b4-85a3-408f-8232-7c5b7fa98263", "comment": "Malware payload (Gafgyt)", "value": "9e11dab1872c9b58dd3c348690db2956bb0395abf4fa45ca5b1bfceaaad54d19abb34b48c6648abcb36f046b4c63481e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764673267, "uuid": "cd284704-e467-4060-82ab-5d3eff1aef71", "value": "T19B43293726A6C9AEC49753F52AD7E6219423B83D1B33A007B3D87D2A9F278D41D1D306", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764673267, "uuid": "6e099e09-c81d-4564-a60a-17d24ba25032", "value": "768:JVTrJLHTxG+KQa+i86VayQ5dnBpH35db0xzcROgncNqySE+/eVtoaNzw4urC:rrJbmQa+i86VayiBpJZrROgiqlj/serC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764673267, "uuid": "44bea7ab-9cc1-43a9-af6a-cfe45fcdc564", "value": 56277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764673267, "uuid": "8ad35851-9c61-46c4-95b0-1f5e7f4c2991", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764673267, "uuid": "2e24fe73-d879-4bea-8a9b-ac78fa0c7cad", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b14a0f13-cfa3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764696240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696240, "uuid": "f86dcadd-a232-4847-b65c-c08a2ddaa28f", "comment": "Malware payload (Mirai)", "value": "c0f0016afcb24f155c27385e955249ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696240, "uuid": "de876e47-75e1-4a44-a632-5d539a5d60e2", "comment": "Malware payload (Mirai)", "value": "e143334ff187b9a35c016cb2995372f9b35918f2ccca2c2336a749dbf2c56785", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696240, "uuid": "41490a61-c337-45b5-a6f0-7291a0276a51", "comment": "Malware payload (Mirai)", "value": "50cc4b7fb061d2ec5881d5886c5c3403f64687c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696240, "uuid": "7b410bf3-e5c9-46e2-930e-c914b92e20d3", "comment": "Malware payload (Mirai)", "value": "31c444cc0bf33f898980add79f8e6bcbd7239a1f5440a7bdb036567e9649e9adaf97bd50a8a70c92a4053ce8104b34c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696240, "uuid": "b6805620-bbda-42ab-8df9-01ac8d7baf67", "value": "T1ADC35A73CC266F59C628D5B5B8718F7927539950814B1FBE28A7C2B58083D8DFA093F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696240, "uuid": "a859fa90-c0cd-4878-b890-d715ff2f58c3", "value": "3072:hYCnm1C+q9gv4Bl1tCuR5pEtWHMJ+DfV:hu1C39gv4BjtCQEYH/DfV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764696240, "uuid": "6457dfc0-4b24-46e6-9b4f-79714df56dab", "value": 125572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764696240, "uuid": "f3eb1f52-822f-4286-81ac-429ec761c376", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696240, "uuid": "666c0805-0a4a-4a16-9003-4708a00b08a7", "value": "nshksh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b32ac01e-cfa3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764696244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696244, "uuid": "99f6b4ef-5507-4c21-ada8-107c09f99eec", "comment": "Malware payload (Mirai)", "value": "48423f70f77bb39d663e7e243f1d2773", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696244, "uuid": "8c0c82b6-4a96-4084-9f57-6fdaea612569", "comment": "Malware payload (Mirai)", "value": "e2e1bf0be3b3cabc2715259b4951fe2935e45fd962fe4c5b141a880e979ea3c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696244, "uuid": "99941f11-47c4-4792-b8c9-67abbd545291", "comment": "Malware payload (Mirai)", "value": "71d8c4017da6b0ec85a5a5d6a808bc49a2d3cb40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696244, "uuid": "13efb762-8e66-4fa7-884a-d5f607a08648", "comment": "Malware payload (Mirai)", "value": "8046c76baaef159e4ae621bb711e379bc3cc8079436931d638361ba54680cef206879a2cdbabd2ae5d603c674550bf27", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696244, "uuid": "f81973f5-c7ad-4475-aa8a-8d99908e1dc6", "value": "T1A0C35C73DC3A6E58C664D5B4B1B19F781B53A950814B1FBE6867C2748083E8DF6063F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696244, "uuid": "91e7e6e2-a4e9-46d9-a441-adf0825b5a9b", "value": "1536:j3QnbW/G0wO7QXTuPCuyKsqdB/5cqpVLWgWVsPz0fvPfCFhIw:jAnbeb77QXCP3swcq36gWqPzCCFq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764696244, "uuid": "d0a85621-6f80-4147-9502-f9c23c6e743c", "value": 125764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764696244, "uuid": "f814ba11-f9da-4964-b8af-59d795bc70a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696244, "uuid": "d5db9aca-35e9-488d-b340-1cf8e7a0fa46", "value": "nshsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02075c26-cf44-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764655144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764655144, "uuid": "e0628b82-8836-47d8-bd24-b7e20c8b997e", "comment": "Malware payload (Mirai)", "value": "a3f124ce195209b71d87baabd9d7f01f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764655144, "uuid": "186cccd4-fd03-4745-b959-d3f12bf37824", "comment": "Malware payload (Mirai)", "value": "e302e4cb52782c34571226c568c24d23c3ea254feecb1b9fbdf64c81f0390aae", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764655144, "uuid": "e05f1487-1c40-49f9-9635-ced8dc45d46a", "comment": "Malware payload (Mirai)", "value": "b2204039eee90593e9edf446aa11f7e5c7a0b431", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764655144, "uuid": "e8394580-10ce-4a16-a2ad-1e88e4b1358f", "comment": "Malware payload (Mirai)", "value": "8c09f87eb67b9c45944080c49fae03dcb17d1f4c0c16fede4eb89688a45fefbe46fe1c5f1735f67a6b1c23ae4b0da4cd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764655144, "uuid": "d9056820-16dc-4af4-92bd-2f165a9dd086", "value": "T17FE05CA895B16C38F2A6C43CA0F9900074128F674A31E91478576C5694EC047B12CE23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764655144, "uuid": "c87ee63e-d33d-4299-8531-5aacfffbd1a5", "value": "6:hYVJXOpkYoANcfQapeRijAHIrnDF9aqYehKPLmAqxncgD7zVHz16GXqxnET531Bf:+nXOprDD5RBIbEecD7qGgxzsGXqsvn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764655144, "uuid": "e0b485ae-6f84-4a64-af94-c6926e0d5314", "value": 427, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764655144, "uuid": "12b5e6aa-2d99-4c20-903a-19e5fe1dcb9c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764655144, "uuid": "28aa846e-a179-4487-99cb-33057c4c9257", "value": "l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "237df969-cfa9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764698580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764698580, "uuid": "3ac4f18d-7608-40c7-a0a4-74d7064fd674", "comment": "Malware payload (Mirai)", "value": "450067549370515ac720a7d49885175b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764698580, "uuid": "93c0926a-b896-4c1d-8537-909576325dcb", "comment": "Malware payload (Mirai)", "value": "e3e7a1b13b451a7b0207359b54b1179301f9cdf73275fb3bf440f4f366ff0144", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764698580, "uuid": "f221099a-d29c-4db2-8994-b69e9008adb0", "comment": "Malware payload (Mirai)", "value": "152bc78ca02012b2502ee3f7da85b1d1bc6d553a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764698580, "uuid": "6e5ab136-d45f-4def-ba84-42bf69f3950b", "comment": "Malware payload (Mirai)", "value": "5d69188228d9e588a464894ace389f8ab7b1826934398dd63c9e24cf1cd1bedfe00cfe16f1de09ff52f5f6d0af9303c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764698580, "uuid": "a88b8857-8a99-4bc9-8d8d-cfafe69f9bd8", "value": "T1467362393E61BBFEE66C82304BF36F70C351219276919345E26DDA085FB128C5C9E7A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764698580, "uuid": "048a9651-f967-4eaa-a008-2bd0087e4f41", "value": "1536:7R0DuDkLMWrPlmhQ3tZcNkieTFAkvVz2w6btXHlnw91xsVGnB:BN1nO1qV6B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764698580, "uuid": "28f05ba0-2edc-4ce7-895e-db8d8b492996", "value": 79644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764698580, "uuid": "92f3fafc-c890-4057-b57e-a2c7ac047ba0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764698580, "uuid": "c4420d3a-ce8f-4e4d-9470-0b14273b5a29", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e69bec26-cf92-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1764689028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689028, "uuid": "05181c4f-373f-4f0e-aa9d-d1067ab5c51f", "comment": "Malware payload (CoinMiner)", "value": "dd8cdce774704b7e64f0fc426d2d2a2f", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689028, "uuid": "3d1cd031-39aa-46c5-8adb-6b095af8b617", "comment": "Malware payload (CoinMiner)", "value": "e48fb8537dae0ddc883d3b19f13211bdcc4f506ce002b99a02241d9febc8f5d0", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689028, "uuid": "fa440569-b219-4c3d-aad1-d03c83232744", "comment": "Malware payload (CoinMiner)", "value": "7191b7318a45a4355d3896701a3f8707ba1a38ae", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689028, "uuid": "3594105f-2ecf-4483-9d80-171ffb0d5b96", "comment": "Malware payload (CoinMiner)", "value": "6e0831025384376401c0dc34375fdb6f49da70ce1c3dba97521d2a9076695cc081c011ca9a1ab1e0f27f5ec909304bf0", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689028, "uuid": "5f01fb16-afa8-42b1-8faa-f6c7ce30657e", "value": "T16CE533E7ADA0607AC5E9F03185DF4F74107D2692230678CB4BE074D04AA7EC6A973ADD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689028, "uuid": "58056592-6e8b-4267-9ceb-0690bb1b4047", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689028, "uuid": "429d4773-8a7e-47b2-bfab-aaaccb5966d7", "value": "98304:3o5CbO+tmWyJISBM0taIn5M4TypQ4HfUclTu9K:3YCbhzyTMxIn5M4TaQ4HfUiTT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764689028, "uuid": "cf97a28a-fdbf-4feb-8350-457b1912fec0", "value": 3212088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764689028, "uuid": "7e0d4ddc-0bed-4db3-be4e-142aeebb9343", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689028, "uuid": "c3e9dfbe-251d-418c-95d1-e16202faa6d4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bdeadff-cfd7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764718538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764718538, "uuid": "25b3ae6c-cd7f-4fb5-a0fa-5e30727efdec", "comment": "Malware payload", "value": "b0864972b55d854ae2d3e46214bb534e", "object_relation": "md5", "Tag": [ { "name": "app-festadomorangodf-com-br", "colour": "#3B4580", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "coyote", "colour": "#E09586", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764718538, "uuid": "6b3b3a29-84b4-490a-bec9-86cded10e75e", "comment": "Malware payload", "value": "e70663f255cdcd944674e30d9145eb09065f55a0507e5da93268f21efe4987f1", "object_relation": "sha256", "Tag": [ { "name": "app-festadomorangodf-com-br", "colour": "#3B4580", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "coyote", "colour": "#E09586", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764718538, "uuid": "6dd14d05-b1ef-4a8b-8298-fe3e0d709734", "comment": "Malware payload", "value": "3796e0fbd93177a56f18827b686ac74ccc819beb", "object_relation": "sha1", "Tag": [ { "name": "app-festadomorangodf-com-br", "colour": "#3B4580", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "coyote", "colour": "#E09586", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764718538, "uuid": "13482458-a9d0-4cf4-824b-40b4df30fae0", "comment": "Malware payload", "value": "38da5efe6aa7fa758770b7e9311816990d282f53ba1eed92a1e7fed7284d6af804723ca44dbe39d84f30418f5f7be542", "object_relation": "sha3-384", "Tag": [ { "name": "app-festadomorangodf-com-br", "colour": "#3B4580", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "coyote", "colour": "#E09586", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764718538, "uuid": "4ef2fd9d-26bb-4daf-877c-e1e40204077e", "value": "T11915042839EB9019F173EFB95BD4759ADA6FB3733703A45E109103864B23A81DED143A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764718538, "uuid": "cfdb346a-c43d-4e63-b260-f19fae5c11b9", "value": "12288:9LZdfrXg+JwuKt/S/605t3bc0zLHRMoAz5UL5vT03jkNryTlZ5TzBZjiRLnBg8Gw:9Lfw+Jwz/S/6GzTK4QHv2zWW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764718538, "uuid": "efe9b555-f88e-41ed-9874-886ea2b473d5", "value": 879104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764718538, "uuid": "a625a534-e7b9-4b0d-9197-ab0fcb8e640a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764718538, "uuid": "58ec7e44-a33c-48f2-a52f-eff5f6034792", "value": "e70663f255cdcd944674e30d9145eb09065f55a0507e5da93268f21efe4987f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "675cc0ee-cf58-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1764663904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764663904, "uuid": "fbf42bf9-8da8-4f2b-ba73-8f3a5d69061d", "comment": "Malware payload (ConnectWise)", "value": "fa76794475daad9ba4746ccbbf1a5bd8", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764663904, "uuid": "4bc9d9d6-b8d1-46f6-ac27-e5485b7508f7", "comment": "Malware payload (ConnectWise)", "value": "e77852e54e64b2b629b6cf189a36b2457de1ed04e20168d9b181e640489b9305", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764663904, "uuid": "8b844d9f-1ba2-4053-9588-f90f787950ba", "comment": "Malware payload (ConnectWise)", "value": "71e58ff3d94adf4596465f556d960109c506af7b", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764663904, "uuid": "0cfed74c-cd25-455b-9822-a0692d0ed156", "comment": "Malware payload (ConnectWise)", "value": "e4d699acf2924c14ee6f5686e4399db88ab2c4c3d097eca85ad6d70195bde172a7465fb65c00c45773c3db07a8222d41", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764663904, "uuid": "75e08640-bb80-43d0-8491-625c87263a36", "value": "T1CB5423586E2113A539D06C775784AEFBBC2A5E0EED33E92273804924B7D89AD30E341D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764663904, "uuid": "577116c1-fb96-4a30-a676-c34797030cce", "value": "6144:/OPfkBZ6xcPQmmf4849+Cd6d/6EUiJIQYXfR5/opLIeMFt4ji7VpYkx:/IMZ6XmmfWCIlXp5/cLYt4AVpt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764663904, "uuid": "a3009473-872c-412f-8e10-2c9222533567", "value": 281201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764663904, "uuid": "809fb31d-9d4a-49c4-92aa-a3b11adb18ba", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764663904, "uuid": "b5a87103-6422-4244-aa49-35551a321b90", "value": "Agent_Uninstaller.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79d632c3-cf5b-11f0-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1764665224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665224, "uuid": "46c5a4b9-7fad-43cb-8bfb-63ad50d134fc", "comment": "Malware payload (SnakeKeylogger)", "value": "eca24379a76dbdfa5af378ef2ff055eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665224, "uuid": "1dd5f02b-dfac-4a0a-a571-b27d0a08cdda", "comment": "Malware payload (SnakeKeylogger)", "value": "e9d589ffd09733b63151369d4e55a9516288ead2b11036016f7f8b02c5c8a6c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665224, "uuid": "c5dcb3dc-9577-43eb-b46d-ab87dffd2832", "comment": "Malware payload (SnakeKeylogger)", "value": "8b77821a1d231fb63b0a955b2fa742d79050167e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665224, "uuid": "b3febee9-1934-4dd2-bfba-4594c158af6f", "comment": "Malware payload (SnakeKeylogger)", "value": "3068491cb692fcf7c8672cbfc1fe7c74080f91600f60e00335aec9adcf652a6760a222b7ffb6ddd37c4408caf5316054", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665224, "uuid": "4b3e61c8-bc8b-4a8a-88ec-4dd1ca86da37", "value": "T12756AD19A3E500A2E87BCB34C9658333E6B1BD569732D20F555DF2851F73AA1CF2B221", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665224, "uuid": "3f680db4-cb5a-475f-9beb-7d3399d7b7c5", "value": "346ff518d94d88a42fb21f2f83557ac2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665224, "uuid": "3f5eeedf-6796-4a0f-89b8-16d5b608311e", "value": "49152:OUpq7+knn8qDWMWplbGUnoH0rbMXM5+2ZfCSpm31WxgTCZvwFrpEMYYEImcfH4xd:vqDG8S5+bUxQCZv2pEXYEEZu07tOO63", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764665224, "uuid": "7362a0cc-0e7b-42bf-95a5-6ff8ff7c5621", "value": 6408192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764665224, "uuid": "89cc827b-85bc-477c-b4ff-b5dd8e4899fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665224, "uuid": "ed932b6e-c279-4ece-9bd8-326b1285a40f", "value": "Dow\u00f3d Przelewu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54b8e1a6-cf13-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764634238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764634238, "uuid": "5c8a6746-4605-4156-b2f6-d3350114bef5", "comment": "Malware payload (Mirai)", "value": "bd78bd94c30040c988e69ae4e4be5651", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764634238, "uuid": "c68057fd-a670-4b13-bb66-da5fed9469a9", "comment": "Malware payload (Mirai)", "value": "ea61acb0ab5e83775f63eb213e9e6112911ca86ea5ddb53ee171868bfafd0894", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764634238, "uuid": "d77f6073-65d6-4970-9783-2780ff30f7cc", "comment": "Malware payload (Mirai)", "value": "2f4f39ab9b19ec64931fc26cd12ccb398e7e14be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764634238, "uuid": "7bbcb8c9-1e34-4a48-b291-5cd35e1180c6", "comment": "Malware payload (Mirai)", "value": "96e0aafc73c94f3b3252f84f29c3424b5b2b7b563ec019c461880b6ebd3191df2f2374d27c7bea8110ce4e5bac539a05", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764634238, "uuid": "c1061701-1090-4ca8-a102-77c76947105d", "value": "T1A3C3940E7E319F7DFFACC23447B39A21975927D622E1C584D1ACEA011E7024E681FBA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764634238, "uuid": "46cf16cb-2540-4d95-90d5-09f2d8b08144", "value": "3072:OVjyybaszYoeNlhtzKlUcR/y0CRYM/orNhUNa:myybaQYFNlhtzKlUsCRorNhUI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764634238, "uuid": "a3f5ec9c-4e88-4c3d-ac79-e243a3994537", "value": 128548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764634238, "uuid": "500c89e4-5cb3-479d-90df-d2f4bf00977a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764634238, "uuid": "4727943d-3843-4772-a765-82a7926ad8ec", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c8d6ff6-cf94-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764689575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689575, "uuid": "b2fb7933-df9b-4c92-852e-f5b6704e8848", "comment": "Malware payload (Mirai)", "value": "e6142ecb1f43c0252435f3e377ffed51", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689575, "uuid": "1473004b-743c-4d85-bf31-f834b1426048", "comment": "Malware payload (Mirai)", "value": "ea6de352cd8e37834fce1f309c07daf8e4120fb97abf2be3e0c98b0d3937a96e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689575, "uuid": "07d7e58c-4df8-47c8-b231-8593bff46efd", "comment": "Malware payload (Mirai)", "value": "666d5c9c9bc3ca0fd02261fbde3d3f95c50b06a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689575, "uuid": "a1ff2c38-7007-4b29-b31c-3975a4c0eef9", "comment": "Malware payload (Mirai)", "value": "37fabfdf921e5be6ac21a266d6d70cd57688a0a485e3a65c48bae8527cda5b97e846d697f3734d7bc2462fad72f69ab9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689575, "uuid": "fff0b02a-f21c-46ca-8e3e-a6ce15e342bc", "value": "T16F342945F8819E22C6C517BBFB6E028D371963F8D2EE31039E245F64378A95B0D3B646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689575, "uuid": "6b999096-eb24-471a-a6a7-ffc8f44ab444", "value": "6144:kE0cpajst/26msxFfDLc4ISTqCrvdVy3bpX:kEBaOtHc4nTR5Vyd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764689575, "uuid": "5dc6ac41-209d-43c4-9eb1-fd8a3d8b0fdd", "value": 234880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764689575, "uuid": "256bc67d-7394-47a2-bc09-31828d3ce230", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689575, "uuid": "6958b150-6bf3-4560-bb56-431f529dedd2", "value": "ecco.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3ae6cd0-cf9a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764692460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764692460, "uuid": "33665959-728d-4f1b-8f69-a802c025b8b1", "comment": "Malware payload (Mirai)", "value": "22ad88b531d4ddd968e89645bad76d57", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764692460, "uuid": "1c780408-bc40-4f32-8c89-aaaca77ed11f", "comment": "Malware payload (Mirai)", "value": "ea7e734ddccf58e719c8cbedc6d545ea76ed86ea926df5f23c9e3cbd480c136f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764692460, "uuid": "3952b097-d7d2-4787-be58-3017154b571f", "comment": "Malware payload (Mirai)", "value": "182c44b5efeec2996e75f9072bf5c09a37f9f552", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764692460, "uuid": "5fbb2195-ef21-40f5-8ca2-a3a450ea5b13", "comment": "Malware payload (Mirai)", "value": "15746c2c04322dad6aeed39c4483ef031db27292a5f286db47c363354cde0942c09df9b673b8a54f2c4a261a5343a695", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764692460, "uuid": "d8fa8de7-534f-4118-8424-b94bcec97169", "value": "T14351A3C6B3D24A31FFB15D9A76F545147480E0956BC3CE86E0FCB8BC094EF095490BA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764692460, "uuid": "bfa21444-0af2-4460-b705-28641b4bc649", "value": "48:vXc+cYcOc0cUpzEc7cgcVcScKcYqUfcLc+f:vXc+cYcOc0c0Ec7cgcVcScKcYqUfcLc0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764692460, "uuid": "c106e119-12ad-4f43-988f-e73c537110e8", "value": 2793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764692460, "uuid": "f908ecc0-c9e1-4c56-874b-de381bd4896d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764692460, "uuid": "e3d90d1c-0a6c-454f-aded-e7a5e1d4a7e3", "value": "lg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e328dd50-cf4e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764659817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764659817, "uuid": "6033ff6f-4fe5-458c-b667-a2af7cf9be49", "comment": "Malware payload (Mirai)", "value": "4c4989843318335a16d9748314e6cbd5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764659817, "uuid": "4083783a-be3f-407b-8cb9-148bf9343e27", "comment": "Malware payload (Mirai)", "value": "eaa86e7ef771f35a9486a0cd8b146f8828a884c8905401596bd47d3b28cb93e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764659817, "uuid": "9a66a402-80c2-4ebf-9cb7-55dc4e7178ca", "comment": "Malware payload (Mirai)", "value": "efaebd27a9db20039d196fea5cc2e9df2eaf0223", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764659817, "uuid": "9fa623b1-f072-470c-83bf-12a83f53dc48", "comment": "Malware payload (Mirai)", "value": "a67bf61544088e1ec527ab05d66bc818339be514f5021488e48117b3961a1eb85595b3b38d602ccd0a9b47201807c979", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764659817, "uuid": "f7c73642-66de-4312-9543-d8e85052a5e9", "value": "T1ACE32949EEA51FDBC06FCE74462E531B179D585FA2F2A33B467CCC48358A3485AE3848", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764659817, "uuid": "2131e8c1-d792-4165-a3c1-723d05874f78", "value": "3072:B/aScig5RumF6zi30pQ+ZQ4K/RI+KF2+5SevzY7IowbiPR/j+a+VP9vwr8tz+ulG:Bg5RumF6zi30pQ+ZQ4KZI+KF2+5Sevzm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764659817, "uuid": "cc67da03-8ce5-40b1-87de-3bbe6aa7e880", "value": 150840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764659817, "uuid": "b4936428-88c1-426f-8ed3-3821577ec97b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764659817, "uuid": "bdf8b590-8a75-4689-ad85-f94530409ac2", "value": "sppmipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c622cb0-cf50-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764660396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764660396, "uuid": "37c0642c-2e4a-4d1c-baf2-e5f1bf5f9879", "comment": "Malware payload", "value": "2541290195ffe29716ebbc7aac76d82f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764660396, "uuid": "93f6b88a-6618-4c58-9860-b12a22701b05", "comment": "Malware payload", "value": "eaa9dc1c9dc8620549fee54d81399488292349d2c8767b58b7d0396564fb43e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764660396, "uuid": "36a82487-33ab-49eb-aa9c-d884f4224f4f", "comment": "Malware payload", "value": "d8e22adc26ef1628b826785682830c3d128a0d43", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764660396, "uuid": "29a64657-ea0a-47b0-9e58-dd463682f129", "comment": "Malware payload", "value": "c1a4f601195489a9ab9bc6344f1aebccd32c94d05d328abe8e3d111088a965cf0be419ecdf69b0a926ede4518cdcb2cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764660396, "uuid": "cf0d7622-02f1-4531-ad02-b67cc051cdcf", "value": "T12BC56F31A2C54237D4732E765C2B97D9A8297E301E24984B3EE47F8C1F3DB917829297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764660396, "uuid": "10f7ac81-9872-4dab-b34c-d497094b71fc", "value": "0fe19ebac03e8916c191ba1f12851fb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764660396, "uuid": "ad409eda-b187-4419-b281-f427be665f31", "value": "49152:JGuaHn27rhus1L9iE2XsZzkA8TbT9FuAHv:JGuaHna1kcwL/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764660396, "uuid": "911caf5d-9d3e-487f-9474-af3f0d1726a1", "value": 2699584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764660396, "uuid": "bc8ba62e-abbc-4849-bfe0-e2f8d66e5c13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764660396, "uuid": "efb33167-82fe-48f6-ba8c-59e5ac5aefda", "value": "IObitUnlocker.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "807d7e3e-cfa3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764696159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696159, "uuid": "f9194a15-034e-46a1-b1fb-274bd6dbe44b", "comment": "Malware payload", "value": "70f41ff8d9dd201e524c5a4df9ac193e", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696159, "uuid": "d93c676f-6639-48d3-ba35-e82f3b12dbd7", "comment": "Malware payload", "value": "eab38fff15b885790083ba4d4e27f51f8a6a50fdd0be204569d71704818e3f07", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696159, "uuid": "ed2d01ed-73f7-4975-ae3a-d54dfafea0ea", "comment": "Malware payload", "value": "b7d2936b82b846e0f3f2066be905249be92dd986", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696159, "uuid": "eab89a6a-7305-416d-8dd2-4c80520f84e9", "comment": "Malware payload", "value": "af056454f3d47d91515357489d4caa3af4f3959741b04fe57804b75006c6cacaef7a1a06b24070f0afb6a51fe9cb4f15", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696159, "uuid": "995975ff-ce2d-47db-918e-cf7a59ce9a30", "value": "T1A846236B55D4A2A8D086CA30A28B538E70D1BA1599FA9C1D3AC73C026F20D9F554FF73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696159, "uuid": "8715d6ce-81b5-423c-afa2-1d570a4fd2ad", "value": "98304:9zuk/EBDMXAlOEY5vi5tmn6v8Zeo/Uo8wW8uj/LIf/ojvNCQIOl6y:TcBDMIwvi5/8QosEWXIXoD7Xlj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764696159, "uuid": "0e439ec9-181a-4615-baee-ea59db13e4f0", "value": 5565952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764696159, "uuid": "c0665a82-f680-492f-a7b9-2cc0911bac29", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696159, "uuid": "f0535f44-39d3-4491-8ffd-b301b2f9f9d1", "value": "dsstorebackup", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6750d53e-cf6d-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1764672924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764672924, "uuid": "3a041480-2efb-4662-ab8d-8b02057a3433", "comment": "Malware payload (Formbook)", "value": "d183775b45bf0e8496d957554e702990", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764672924, "uuid": "6fa0ede7-22a7-43d9-8ad8-84e19ea745ac", "comment": "Malware payload (Formbook)", "value": "ecd80dc690eee6d7f89ad7f036aed2000c548440fabd8df91ab539307eb317aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764672924, "uuid": "7a95dc37-8a22-4a84-9542-a6adbf5652c0", "comment": "Malware payload (Formbook)", "value": "52ebe1d296fbcc2a98bc3c0426013fb8dab1036e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764672924, "uuid": "e0326632-7d75-4f32-ab9c-a0f686872f23", "comment": "Malware payload (Formbook)", "value": "99dd65a48ebf754391b2ea99d5119c4c7b94f43dc283d2bb365dd13b160c82efdeaa8334c8724aa90b16271f32581f2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764672924, "uuid": "a600cc97-9564-417d-b55a-437dbfc6a497", "value": "T146F402234AA9DB13F4A953F51933EA781B793F4DD111D7AB4BEA5CC73A183001E88369", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764672924, "uuid": "f85c75e0-a834-4f0b-b682-94b8e98aa6e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764672924, "uuid": "9bb883dd-3def-451b-8acf-96f0cffa1cb5", "value": "12288:Ks/H8kKORwzlJOirGwn8lDX8tyO0W1U78inlwiB5+Tck9cZwTUk+L49xHCg:D/fKORCYir6Dstj/u8/n9c2TtDDC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764672924, "uuid": "f9a0044d-b4f0-424c-a652-a3fdfb6217af", "value": 770560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764672924, "uuid": "c60a0d86-cfb5-47e3-87ce-67cc7516e68a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764672924, "uuid": "bf75caf8-1fd4-4a18-a8a3-88393099855b", "value": "PO-071924677.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "260a419a-cf94-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764689564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689564, "uuid": "3e800d1c-2a98-45ac-a487-378cf51c1475", "comment": "Malware payload (Mirai)", "value": "1b1b3768290e334aba1e23562226c9a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689564, "uuid": "d15f2df4-91f9-4fd1-8d6b-dc793e6a5688", "comment": "Malware payload (Mirai)", "value": "ece4dd263cab93119e6930d0b0e33f1a479c6331c9a89338ff729cd7d616d425", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689564, "uuid": "c6bfa63e-4619-4a21-983e-f803c038553d", "comment": "Malware payload (Mirai)", "value": "ad1d9eac539cdecf845e87fab84f60f292dcf006", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689564, "uuid": "f5e5bd8e-57c3-42c1-b1d8-0bdd805f14d9", "comment": "Malware payload (Mirai)", "value": "8b4a17166f4e719496260262e7abe5c38ff99b3937ca8c03b9eccd87c96a9e3b8d15f0fe93d0cc68b78156923b4ba3e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689564, "uuid": "fd2a2c0b-dddf-485a-a0d7-50bd66ff3e2d", "value": "T17E346B0AB68080FFC1D5D1381BFFB536E831F1AD5279765A23D4AF262D4DE204B2EA45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689564, "uuid": "661cfc7b-ca81-4302-a58b-1d1af3eabe0e", "value": "6144:3ZvzvfKKv5YcJ3QOOD1mQ/Gu3veYLw5Jrc9N5V2b:3VLKYQOOD1m7u3GOw5My", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764689564, "uuid": "8e48ea09-3d09-4f23-9f0c-4f7613f34d15", "value": 246184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764689564, "uuid": "c922f0d4-3870-4aed-a2a8-97504747715f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689564, "uuid": "9634a872-c04e-4f06-b81e-52b91f0ff23a", "value": "ecco.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b0f60e9-cf94-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764689519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689519, "uuid": "f334070c-5167-43e4-bdb1-7072a83aa873", "comment": "Malware payload (Mirai)", "value": "c8e23d5f1f7e5501c3c81daa42818e61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689519, "uuid": "19f2e8de-390d-4d0c-8118-79aada317124", "comment": "Malware payload (Mirai)", "value": "ed759b194168655768454dabfa5d438a36cf85d8cd0072ce7da4e5a72c803168", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689519, "uuid": "f98c6dc8-a32f-450a-8993-5f5f02fdb246", "comment": "Malware payload (Mirai)", "value": "f0b2b615c9cff8f9449ad1e93e68d4db3d6d1dfa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689519, "uuid": "ab0a8bbb-0518-40c4-8999-eff2957b8eed", "comment": "Malware payload (Mirai)", "value": "4bee3683255018397bc318853c4ab47f881d15ed0b0f8cd90941e7b357aa7dd941dacba623a4765061f818f8219122e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689519, "uuid": "9878f12c-8408-48a8-b7bb-fd4a3b9bf163", "value": "T13A83121170A39022D96418737FD5C60FAB6C2CFDE7D431DE24A614582E8C48B96BDABB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689519, "uuid": "cfd38504-dba9-41fd-9f83-52c2e5e27c11", "value": "1536:xN1fr/ZBn5jGrIidAQYE3PWN8rTfJywr3QFfYCC+/WixL2Lb:xN1fjZhRdjEf68r1pjQa+uisLb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764689519, "uuid": "1c939603-6c36-4bca-b1e6-5c454117cc47", "value": 84992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764689519, "uuid": "b4dcb36c-a415-4e89-8364-fd0d47c58d99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689519, "uuid": "f4fe2e8f-c6e0-4a43-8efa-ef5cbb3be364", "value": "ecco.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a1b9d46-cf94-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764689571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689571, "uuid": "5b48d19e-4dbd-40ed-b492-5c0a79fd703b", "comment": "Malware payload (Mirai)", "value": "fca4e4dbdd039a086f7225fd17dd9cf1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689571, "uuid": "fe8bb4d3-65e9-4899-8885-853795f4927b", "comment": "Malware payload (Mirai)", "value": "edd5c6f137d1bae351e8127f5f507698439d48005d429fb58b5a681c28bf5135", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689571, "uuid": "9b9e8129-12e3-4b18-8599-66c29a11b083", "comment": "Malware payload (Mirai)", "value": "0401f3c6e73db4ae139c53c09cfbb73ca21568a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689571, "uuid": "fa66d2a4-8dda-4bed-97ec-b92507b5b7fa", "comment": "Malware payload (Mirai)", "value": "cdfbff24ca6d7476c39afaa2b4c4b01d6f4d076c34f43fac5041ef16295185dd2658af130c871ea45f8d3b15eb7d1410", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689571, "uuid": "5a7b4074-2c36-4af1-8d55-96612aa3d368", "value": "T173243980F98781F6D807853450AEFF3F8B3199A6C176D64DEF996E32DA27641422738C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689571, "uuid": "e83dd94a-90cb-4134-be5f-802f75eef9b1", "value": "3072:t40LmYJHs/2hRfBI/ENl3HWEL/g3j7h6KO7xRiIF/zf7OD1tWJOrSd:1LmAMgRfBICl32o/eEB/zKR8JOrSd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764689571, "uuid": "3ca605ee-1efe-4033-ac4b-c3ed96321a13", "value": 215656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764689571, "uuid": "748eb270-bc17-40cd-a379-f9634c1e70d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689571, "uuid": "2deaa709-3c2b-49b3-860f-a8190dac7d69", "value": "ecco.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bc84357-cf5a-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1764664636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764664636, "uuid": "2fbfe7b0-dd9c-4b67-b92d-488b2c36f96c", "comment": "Malware payload (Formbook)", "value": "ddd084b6d5f0411d8ab3a900b13b7767", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764664636, "uuid": "01872fce-a21a-4c3c-92fb-6872cdd5729c", "comment": "Malware payload (Formbook)", "value": "ee24d1c68ec644cd69c853d7612b0f4df749aaddf322fd94e146fe0b6269aa16", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764664636, "uuid": "fd20981e-31bb-4496-909d-33be66ba33a8", "comment": "Malware payload (Formbook)", "value": "35921d68819a7c969cf0c9de6c944c253c1524ed", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764664636, "uuid": "493539f8-18af-42ef-b82d-eba0e1e0e91f", "comment": "Malware payload (Formbook)", "value": "5cdcee41ca4ca1d5f5e3aaddb6edd849f48ddc09f3635ebcae6bce337a146230a86692c8c7f5cded4afb7bc6ce4ebfd8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764664636, "uuid": "856d3d8f-21cb-417a-a6dd-32839b034ad8", "value": "T142A5B15D84B1ACD2A054FEB4F685FFD78CDB5385162B07420FE4859A3312C83FAA72A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764664636, "uuid": "79492995-e209-4539-8563-30a51db75054", "value": "12288:P92z2zEvBqnNitAN6Ur2+vTaMQHfVoFhy9aB0D32zlNEWItZVaS3oQiQZDSmuPSG:k2/NiqN5/aD9h/6xowkqqSPW2JIsRrYw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764664636, "uuid": "2064853f-acb6-4b33-ba6d-523c0289b104", "value": 2116560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764664636, "uuid": "b7d562a3-606e-423b-93a5-0d54bb5cc7c2", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764664636, "uuid": "8f967229-8dad-42df-bf3f-e7c32d4f24e5", "value": "266714718-053055-sanlccjavap0004-16649.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33f6baf4-cf3a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764650933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764650933, "uuid": "a4ad09f0-146a-4f85-a366-cb09929520ef", "comment": "Malware payload (Mirai)", "value": "a92d3fc46391053b5ee9feea31b6f064", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764650933, "uuid": "fdd65e36-c28c-4843-b6b8-5d7954dc2351", "comment": "Malware payload (Mirai)", "value": "eee7a5181276d2eb86bda3a3977430d5c713075ba65f9ff371bfa23daddc1b53", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764650933, "uuid": "107c0cda-4108-437b-86a2-a79788ebf1f2", "comment": "Malware payload (Mirai)", "value": "61a3246c8e15baab725bad364ae9c5c8e4daf311", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764650933, "uuid": "a06c7ad9-5cdd-4421-b855-da5075384338", "comment": "Malware payload (Mirai)", "value": "38b530dbd50b989e33058db6f0dec9e6fef5ba4d0c837d410d194f56280472eea406f6be9d26d9662fb6f8ee03d90153", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764650933, "uuid": "95d2cf95-be4b-454f-9fd2-72132d6aee2e", "value": "T1ACA3E094BB11BE4AC06123FCB5800950E7B16DF90B9766078163B9B8397DCD87F0AEE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764650933, "uuid": "5b243d80-0e82-4743-a995-aa06fec7fc82", "value": "3072:gzNQEfZZyqgHPzhRRWph75Ir4RPyDjzwuT:GNQEhwnHPz4pB5HKnzw0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764650933, "uuid": "3c8f2033-5813-479f-81b0-5c075c707d80", "value": 103672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764650933, "uuid": "45224eb7-bb32-46b0-9867-ac0ea4d12f23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764650933, "uuid": "2416d533-81ce-46ec-a5c1-1b323dfeb098", "value": "xnxnxnxnxnxnxnxnriscv64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "991ee8b5-cf6b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764672148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764672148, "uuid": "fd6355b5-2716-4716-b8b4-76c57116425d", "comment": "Malware payload (Mirai)", "value": "02e672b7f8c91833fcc38bc903ab4252", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764672148, "uuid": "12d819c9-c0b3-4d58-b471-51109cb5dfb5", "comment": "Malware payload (Mirai)", "value": "ef67d05f8d7d6fd39445b049aa41d556b49b594fbb4a06f765a04e7265e327f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764672148, "uuid": "bf1d251b-0b05-4fba-adfe-190ee6378692", "comment": "Malware payload (Mirai)", "value": "4112b3020e9bb085c86dd2489c735daae6735704", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764672148, "uuid": "64a8f025-8ad4-44b9-9922-9bbb2a150ce1", "comment": "Malware payload (Mirai)", "value": "9bd6c509889abacf25918b52894deddab4d89dfb2cbeb3a14db4491ecb1ecf06d0ecfa266183e70e21b34ba67ce470c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764672148, "uuid": "9728530f-79be-4804-95ec-89ca61d1c6f6", "value": "T176B30686FC828A2AC6D1537AA27E225D3361A7F5D3CE3213DE540B2536C920F4D67EC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764672148, "uuid": "b5283d35-a5c2-421f-a4dc-14890bce7c03", "value": "1536:TkjaIBNIsvRHUbEQPOYQx0TJq6sVAVU2msJZQDlumUwrwIu:yaIBN7gc/CUOXAuou", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764672148, "uuid": "45921021-eb2e-4c4f-ac30-e8355a99e19c", "value": 108308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764672148, "uuid": "082ddbd3-f6fa-459c-ac6c-8f8a35a752fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764672148, "uuid": "c0192a8f-ba4e-42e9-903e-e4c7fe7a7896", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a18511bb-cfa3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764696214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696214, "uuid": "c015d7bf-4af2-4647-b81b-c8af94f947fd", "comment": "Malware payload (Mirai)", "value": "ddfda40dd3fe323fff29b9682096da1b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696214, "uuid": "83bd5e9d-76d4-4408-8168-356190f24b32", "comment": "Malware payload (Mirai)", "value": "ef87812d0e79c988cc908997174ef4e571476610c22d91b634446191e53dbba3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696214, "uuid": "d5ef9c78-8036-48d9-a204-d99e3bd5af4f", "comment": "Malware payload (Mirai)", "value": "69b46b9191b97129f32cea28d96840d7ce9f0bc0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696214, "uuid": "e68a291a-aca1-4896-bb26-5e185db72395", "comment": "Malware payload (Mirai)", "value": "820dd91a1776ec4371b53417f555a3043e0a9d4829febe28ff7fee9fd2ecc1943c8a0834b3e4489d7d4f8f0810ea5440", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696214, "uuid": "c46f53cd-7e40-4e04-9e4b-a4eb61df0d51", "value": "T1F7935BC5FB83C0F6E85709B55037A7768733E83A4039DB82D76AA936EC52901DA1B35C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696214, "uuid": "c251dd51-df6d-4604-b471-3aba4bded687", "value": "1536:vxnty/Is5lBzJNN20uoI9CH1MtrGmwdHeg3ZyStZI8VM:5A/I27NdufK1MBGmeHDbo2M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764696214, "uuid": "ae3dc2b1-580b-448a-91be-59d401936449", "value": 96428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764696214, "uuid": "8c84c0fc-7536-4b33-9149-818bba9bcf4a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696214, "uuid": "4ff0b45d-1f13-48a9-bf5f-31e9afedfa4e", "value": "nshx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ed86ab6-cf7d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764679781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764679781, "uuid": "e6920287-b758-4f8f-9487-8381212f485a", "comment": "Malware payload", "value": "6bf3874ba9162124367ce898b708c016", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764679781, "uuid": "0b107897-5bb5-4c26-ae9a-c7336c22211b", "comment": "Malware payload", "value": "f0a7b7f9b384b8d952400ca5311f8fb31febb9152d02e783fe5d32c8a466a282", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764679781, "uuid": "bef57eca-9491-42ce-9bb1-e507676f335d", "comment": "Malware payload", "value": "c86eb8f8f3a9f816ae05059c7d6cb8cfc2a83aff", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764679781, "uuid": "14c8ec0f-ecc0-4cd7-9224-a924d1c968e9", "comment": "Malware payload", "value": "bdbdcd61cf7c09c4ccc41410cbd967acfd7a40d345735c7e451ab8d47354d8d5403e77401adb662c5e77e73117b4643f", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764679781, "uuid": "4cad1d79-11d0-4d4b-a39c-38abee43a971", "value": "T11973648949CFD9E8FE27786485DF8C02F7B58503071CE6A5FB5DA8A12F41428E1F89E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764679781, "uuid": "8e92b354-20c3-43a0-bd45-7e33b072fd4e", "value": "768:SFeUYQ/KMRl6ZrS7rmwPbHHU3s/drRp1TlVC+m0Hxu/Ph22lX2skQjIrERlsmQlQ:SQUdVd5homMZw/UL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764679781, "uuid": "30cc5fa2-3a0e-4eab-93b8-774e1c5abf61", "value": 76363, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764679781, "uuid": "14daaa6b-6ade-4807-b6ba-eab7b5ef31be", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764679781, "uuid": "a7bfcb01-59d7-4078-b262-dffe549d18a0", "value": "1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2e8e79a-cf70-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764674446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764674446, "uuid": "d200195e-2f0b-4d9d-957a-721779238dc2", "comment": "Malware payload (Mirai)", "value": "47a49664a37ac4dad15a52f3c368a789", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764674446, "uuid": "3bbc744c-e1c8-45ad-b07c-f73f4008c951", "comment": "Malware payload (Mirai)", "value": "f133ae2173359985566c4df012e64f4effdbf05740701496fe79a2f15f963c65", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764674446, "uuid": "b03b932b-faf7-4a4b-b534-3bbfd082bd23", "comment": "Malware payload (Mirai)", "value": "58f6985d967efee3cde6d806a71da99aa98390b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764674446, "uuid": "36b7e40c-117d-4817-9692-8bf23f2ada73", "comment": "Malware payload (Mirai)", "value": "b73f49df730937dbf897641aef7a74cb1c8a57c5e6f75b5920de10d34a161b46eee1e115824db7d3cc66b1cfa50db80c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764674446, "uuid": "f5febb0d-66ec-48e6-a889-d7e4d03b809c", "value": "T162149D9BFB8A09D1C44711F01B8B8B9FAE1711475EAFC2E2696939372C6D0CB5131BE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764674446, "uuid": "0b598934-05c0-42b7-83e9-263a5a0a16a3", "value": "3072:LloBVTvT2TOXYRfNK5W+GldlEVaiyN8gr1eq:xo3L26iFllbD91eq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764674446, "uuid": "863cbc6e-ea0a-43e4-8f57-059365a1da65", "value": 198268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764674446, "uuid": "9aad589d-e23f-4ce8-8ac2-f471907824de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764674446, "uuid": "31fe9cf3-6eac-4d49-9c13-cab6b5b7abf3", "value": "morte.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "563b9ac7-cfa2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764695658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764695658, "uuid": "95edb13f-e6dc-4564-82b8-3abbffe1ae19", "comment": "Malware payload", "value": "7119eade7ce552964bf2530914747786", "object_relation": "md5", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764695658, "uuid": "07074de8-2341-46ef-8611-599e48bd1447", "comment": "Malware payload", "value": "f1bb4707775a98581afa3d6cf8cc192d6bac1f22066f91c0373e2d7bd254189a", "object_relation": "sha256", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764695658, "uuid": "3efe7159-e00b-404b-b9eb-84ed5727ec9d", "comment": "Malware payload", "value": "187fd0e9f584d2b8b25f113376e8259fe8d387a3", "object_relation": "sha1", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764695658, "uuid": "6b3814fa-be73-467b-bda7-b42dafff7e96", "comment": "Malware payload", "value": "8257a3c98b81e4795878118b750624291a9c1bc7f7f93447331a510f21eacec24c543dcfd86ea25fab196863aff2bbb6", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764695658, "uuid": "11835bbc-53fd-4a33-972c-c985451066b5", "value": "T12F66232AD82573419359203AC9130DB5FD41231FF27BDD08D3678E6B29F49AA7F2D862", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764695658, "uuid": "70de2071-0717-4354-bfa7-2cc8b608e238", "value": "98304:OSsLgHdSsLgHKSsLgHcSsLgHLSsLgHKSsLgHqSsLgH6SsLgHpSsLgHgSsLgHoSsg:YOnf8f95sbFlcMyaXWByI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764695658, "uuid": "8825dd92-f246-44ef-ba45-bcd46346e4b1", "value": 6668288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764695658, "uuid": "ac90e6a7-9c34-4014-bcf2-120e780cf872", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764695658, "uuid": "9a7c829c-c7bb-4bca-b75a-94d7023411bb", "value": "Accounts.-WRXHHC5.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32a8cb7f-cf76-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764676701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764676701, "uuid": "532fcf0b-f0f0-4952-b434-89236f3bd4ac", "comment": "Malware payload (Mirai)", "value": "19e0467256d57d576028002931311799", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764676701, "uuid": "af693e71-5d4c-4ac0-9b8f-ff7a3e8c28bc", "comment": "Malware payload (Mirai)", "value": "f306d2038c1524168f7a349ef31e3f5eae4ce06182f1d855a08702e7633d49ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764676701, "uuid": "1a8e2716-07af-43d8-a8cf-a6377c387d33", "comment": "Malware payload (Mirai)", "value": "e2cf95a9e475b18508f3aa66a465461bdaf445ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764676701, "uuid": "d8f24b5e-6d22-402c-b269-ba52cc290e0c", "comment": "Malware payload (Mirai)", "value": "2c9f0d2c7515188dba5b22903f0046605c08bfcd92c9ef9ec2d46ffb715016b72e503d44c6a184e649ec1520613f16d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764676701, "uuid": "593dd1fc-58ec-48d8-af0c-364463eeb9b1", "value": "T12534F60ABF600EFBE8ABCD3702E90B41249D555A32983F75B634C818F64B24B95E3D74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764676701, "uuid": "13ee9d11-3c6d-4fe5-a6dc-64cbe473f0fd", "value": "3072:WPlry3TdOLCJjOsXuC2yFIEhkI4PbgVskm6MiQEwxB8Q2t:IrATdOLCJjOsp2QLhv4P8Vj1MDB8Q2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764676701, "uuid": "dcea8fd8-633c-4eef-85cc-7b4a30bccace", "value": 231668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764676701, "uuid": "2d7aaf3e-534a-4e08-8daa-4b701509c66d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764676701, "uuid": "24676c6f-a081-40af-bfd6-4f72ea9f8519", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0ac24e3-cf7b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764679167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764679167, "uuid": "d16eabee-5c6d-42b2-b108-d01958fb262e", "comment": "Malware payload (Mirai)", "value": "5ccb8014b8ee68c0ca1fefbf5e6df025", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764679167, "uuid": "19c23f4f-3231-4479-a471-b967488c3845", "comment": "Malware payload (Mirai)", "value": "f4ca4acf6b38c225ac77cce4182f1e66cb11dc6482ef0eb2774940b04bc189b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764679167, "uuid": "2420747d-11bb-4219-b8d2-ed202a425887", "comment": "Malware payload (Mirai)", "value": "ef80c6068ca026270cac3f0c0cffad45cc2b7f67", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764679167, "uuid": "9ba92f5a-1b67-4b4e-99b7-4a27085fcc8f", "comment": "Malware payload (Mirai)", "value": "a201db856e08a0049928234973095fba24c7cfabbb3dfb2607a6323f7c7287820e7f35dbc4d7117fb35584667eea7416", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764679167, "uuid": "ec2d1f89-3dac-40ea-8b39-3c47882e9499", "value": "T1FEF34A52B68040FFC196D03817FFB136E865F0BD52BC768A27C4AF163E4DEA05B29649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764679167, "uuid": "bee8db2e-8d6e-4bf5-b4d6-87b64a605ac9", "value": "3072:0C9yxUfKSHu4giBmde0VtnKwQVrE1u1q/xAT4CB6loWPW755g556:0C9cUf1Hu4giBWe0VtKwQtwx64+6JSg6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764679167, "uuid": "edc1b6a6-186b-4f13-90cf-86352b7cdd84", "value": 170376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764679167, "uuid": "b2bab14b-d588-4325-a144-79187786bbf6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764679167, "uuid": "6072d29a-fa3b-4c11-9500-d1f7489af96a", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d03252de-cf7b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764679112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764679112, "uuid": "18f50cef-4e71-4b58-9276-de5e215805e6", "comment": "Malware payload (Mirai)", "value": "da4b1b63eb69dbb89d84dfdb722511d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764679112, "uuid": "44a681fc-20f0-48f9-99f0-f65c2e741e34", "comment": "Malware payload (Mirai)", "value": "f5b16d5bc2ced6ee19b953ce41709cc94a1853518bf5b8838d9fbadb272df6da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764679112, "uuid": "a1c9156b-6ef3-4559-805b-b1b48ecb5740", "comment": "Malware payload (Mirai)", "value": "7dfb7a014d3bb597b4e4a3fc27738f409c213820", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764679112, "uuid": "98eff915-6b92-40c6-b32d-bdb3390e64f3", "comment": "Malware payload (Mirai)", "value": "3690e44319467280d57ea0c50248c1c61febc6c5231489279d6b136ffb45ae30c2a911cf1f1775410fac19b775f4bc1f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764679112, "uuid": "bdc318e9-e28a-49ab-9714-5ae651e7ae5d", "value": "T1FE045DD6B401DD7DF84BF6BA481B0D1AB960936135931726A39BFE86FC320E18C1EE45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764679112, "uuid": "326a2c27-a1af-4333-a837-b3f488968908", "value": "3072:uYKwkfRx5g+R48XxIGokIcyGpiOAYOFV7FgmxVTN52D:AwkfRgAtyG8JYwV/x5N52D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764679112, "uuid": "1d2f49e6-42b9-4f24-af4a-780721f35ec6", "value": 177640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764679112, "uuid": "747017e1-ee7d-4879-902f-4be3329eaea4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764679112, "uuid": "dce979ed-3ca0-4a85-9d36-b46f31a7d667", "value": "morte.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80769a58-cf6b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764672107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764672107, "uuid": "df40cf00-03ce-4eeb-a4de-9c3d3d3a3d69", "comment": "Malware payload (Mirai)", "value": "cdb470f3666c3ec0e364527833035a10", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764672107, "uuid": "3102d68a-c662-485a-ad0c-441c4283af57", "comment": "Malware payload (Mirai)", "value": "f5c4f14348563783b13328435754508f1324944f1a639f91970a870f607ab62f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764672107, "uuid": "cb5a285c-18ae-4696-8062-9b8298aaeea1", "comment": "Malware payload (Mirai)", "value": "4d7ceea0e1893798642fbe88ccb056c2a9b844fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764672107, "uuid": "89e751bd-a3ef-4f21-bb21-64c73dc24815", "comment": "Malware payload (Mirai)", "value": "41b260847eb16e33712e5b1dcb803e074a4a17c83bddae4ab3cd336dcd2426edb3fb64bf074d393b5672826cfaa51024", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764672107, "uuid": "15ad4416-f6d7-437f-b79c-8f760dd28265", "value": "T16A43F23C7EE0DD13C5B1707EAF748A1D36C40EAAD0E92953F5360C6C95D061BABB9286", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764672107, "uuid": "96b16ac0-77c7-4aaa-b34a-7118bc996442", "value": "1536:gaTvRLCpuO45Kb2R4SIjnHDd3VGlQokSxLz:gmRNOkyLHFakSxLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764672107, "uuid": "bf1dd963-2bd6-4b58-bf44-bdb609142eb1", "value": 60480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764672107, "uuid": "1d5c945d-f368-4af0-ac22-36dd2392ad18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764672107, "uuid": "0930371e-bef3-4f84-ab1e-7fead61875ea", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcca95c5-cf93-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764689388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689388, "uuid": "4633a8e4-4c88-4b61-964f-b45d3e881f1d", "comment": "Malware payload", "value": "d800429c837d7aa29ca43cc409cc0bce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689388, "uuid": "32234623-4989-40c7-963c-4b110b2f2ad8", "comment": "Malware payload", "value": "f62029fba98f3d6d8147410e56c667d073952edd88739aa4e83d9c6418464caf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689388, "uuid": "9459d987-b245-49f4-ae99-aa42dde1bea5", "comment": "Malware payload", "value": "35a073bd770e298e102155ef54e7d9b77901316c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689388, "uuid": "6e2e1fc2-a39c-485d-bd12-51e89780d709", "comment": "Malware payload", "value": "f90798edbbad3f1f19aeb33636252b5fabfbfb5b57690235ea18c3a1fc1c81921a41283c4e58f8f0ee3158c90171a757", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689388, "uuid": "8d4dbfbd-b5b6-4af6-9a15-87190fba313a", "value": "T177B47D9DE6A407F9D1EAD678CD024507E772BC464771A64F03E08EA61F236A09E3FB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689388, "uuid": "0c773299-9136-4de2-992d-95ba50005b50", "value": "767ff3ea6fe2972cdfaf27b2138dd49f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689388, "uuid": "3b5f3308-a817-4c17-a627-2156ae504761", "value": "12288:nyap35Kbei2whY2zSikbcetqCD2vchXCa3+:yap35PSq2Hk9gy2EXC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764689388, "uuid": "124f28f0-786d-4c34-949d-cbbae5c8bf59", "value": 533504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764689388, "uuid": "5fbd6119-3594-43f1-9d1f-aed03baec99f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689388, "uuid": "f45cb44b-75bf-4733-85a0-124897623abf", "value": "SecuriteInfo.com.Win64.MalwareX-gen.31535762", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "038d1b80-cf44-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764655147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764655147, "uuid": "db955f52-f6fe-4cb4-85fa-96e0c4a9cf39", "comment": "Malware payload (Mirai)", "value": "0cea26ec7ea3360ad9983854e7ee76d6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764655147, "uuid": "adbb3f91-debe-4fa7-867e-fb050e6b75df", "comment": "Malware payload (Mirai)", "value": "f6298e5ac3ce0f8b97113a6e72f7547545801ec8c1ddb19daab74c0dde0c66fb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764655147, "uuid": "f05a7964-4b97-488f-ad04-4910d1e96e42", "comment": "Malware payload (Mirai)", "value": "20ea2e71cc3e1d4e8f27c339cabd7ee430a46498", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764655147, "uuid": "f9cf2044-18cb-48b9-af1a-74d42b858390", "comment": "Malware payload (Mirai)", "value": "08b234ee823f9f08fefde6950066abe26ec5fd8db4c42421032f7b3ad3ab223cd69ce9ca1ffb82b6192d7d64f6d3affd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764655147, "uuid": "f98de7fc-da41-473a-864e-1e996d317339", "value": "T12001E5E9016B32D41AE5D93DB43B9D5170509A7B19714E85B8D43CF1C2C4D97B036F47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764655147, "uuid": "7261868a-2852-4cd4-861e-b124c0c0d420", "value": "12:+q7MCGq5MiQWq7iMv1I7qAmlqqGVzdoFqRGkP9qjWpKWq47LsnWq+LA6YX+v:h062+x2tfA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764655147, "uuid": "ec2093cc-cfc4-41e3-9a33-454e866e4006", "value": 834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764655147, "uuid": "05122ba6-3b84-4b90-978f-ea74036c52b7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764655147, "uuid": "481485da-5b82-4cd4-acd2-d0698418412e", "value": "c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a167615-cf71-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764674485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764674485, "uuid": "9c716d89-5227-4e16-b873-d86c0916a2ac", "comment": "Malware payload (Mirai)", "value": "a80a0b83459de54a672c372416e6dfa8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764674485, "uuid": "2faf79d5-60d0-4a03-9727-ba9178381829", "comment": "Malware payload (Mirai)", "value": "f6731ecf1cbe9dda056669063ed22ab7c82d1b563bfeb2b5e080f48427e5e27b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764674485, "uuid": "107d43ac-8eed-4eed-85dd-c3c01142130c", "comment": "Malware payload (Mirai)", "value": "0cce18e0f91f6e65da27a40e99f2ce934712819c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764674485, "uuid": "b9e84820-e4b0-4132-81fd-9c12b77d9017", "comment": "Malware payload (Mirai)", "value": "3014aecc002f82456cc0c4a07c0ef534491072801f679b09538d6432c6c203f232672d646d3d92a83cf0e8f8b6309a60", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764674485, "uuid": "c6b5d4c0-baa5-474c-835d-1e55b64da65b", "value": "T121045B42B33D0E07D1D61AB0273E1BE557AEE4C212F5B581299ECF1E8136E761849ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764674485, "uuid": "4630936d-a0d0-44e7-887e-0d6092d3fed8", "value": "3072:0XOxXZHG0icb+v0NnrKdvywq4zcc/b7tecn/wS23oLw:0XOxXZH3bfKdvyPkb7tNn/r23oLw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764674485, "uuid": "6225f9c7-4c43-4812-baa1-109dd9ffbd71", "value": 173856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764674485, "uuid": "19f7211b-138b-4a07-bb48-5672f57c92bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764674485, "uuid": "2ebd02de-b6b0-447a-bd56-e0db25b6f151", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4af8bd7c-cf2f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764646247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646247, "uuid": "bc05793e-50ac-4654-84a2-cf57b5eaace6", "comment": "Malware payload (Mirai)", "value": "79bf2abe278159f89ae98af749103afa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646247, "uuid": "9a025631-408c-4447-ba67-cd20f3a97357", "comment": "Malware payload (Mirai)", "value": "f673ce8ee4586f3705524ccb50c0a9eff049a2b55a5638f0f85e8212cd0eeac1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646247, "uuid": "2d89ffa1-88f6-411d-b4a9-fb066e7acca7", "comment": "Malware payload (Mirai)", "value": "1a42e44de4cfa645b0999e57bb194c11488b59ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646247, "uuid": "33e1f383-0b1e-4f21-8031-e6fa7ecdc28e", "comment": "Malware payload (Mirai)", "value": "5a1020f39a19b1eb7d26d6139d9a0387a474594fba4705095224fe3ed45bb0eb702a9e90bcd48f241b8e4e49a6e1f014", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646247, "uuid": "be8df8d2-cba0-449c-9b56-c0c4183c17d2", "value": "T19953E58178919A17C5E422BBFA6E018D373563F8D1DF3216CD226F2476C982F0DA7B52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646247, "uuid": "00ebba65-5591-438d-92ba-c71723fcea06", "value": "1536:gP1IwP44TCRfNdbYakabDrzKQlG9Wcq8JJTnd42+:gP7V4sazKUG9bqAJTd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764646247, "uuid": "1ebaff84-7937-4068-9476-85bd5bec3580", "value": 64460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764646247, "uuid": "28c31c06-7625-4ce2-a688-6398bc78c984", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646247, "uuid": "b3ca38f2-96b6-49f3-a3cd-ae83f228fca1", "value": "jew.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92e97620-cf5b-11f0-a129-42010a9c0007", "comment": "Malware payload (a310Logger)", "timestamp": 1764665266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665266, "uuid": "b7df586f-480c-4875-9c3a-d52ea86334c1", "comment": "Malware payload (a310Logger)", "value": "2f722c069bc2612c7cf0548c625b34f8", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665266, "uuid": "0e344d7a-a275-4df9-947f-eab53f09de33", "comment": "Malware payload (a310Logger)", "value": "f8aa02fae887ea80156c2e8be3940405bfc612434d7efae60320a802a9d15a93", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665266, "uuid": "9ce0d558-1098-416b-866f-fe8c96ddce48", "comment": "Malware payload (a310Logger)", "value": "be4d67974e02309f3a4f10b882b90306a719cc43", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665266, "uuid": "ea75994f-66e2-475d-b609-36c7d1189274", "comment": "Malware payload (a310Logger)", "value": "4c51e4c0c1646c7468d36d94db2b8e73eb6aedb447f9f7fb712d230ea41b21d6e35ebd26d5ec7c502c958d88bb456790", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665266, "uuid": "05772f8c-e5fb-4979-9a8c-141654def3cb", "value": "T1FC55F02917E95A14F0FF5B38B77800640BF0BC2B9A31E66E6A5241ED4E61F49ED21373", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665266, "uuid": "d1bb5da1-7c39-42c5-943a-f972b7adaf6d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665266, "uuid": "51e5cfc7-48e2-4060-ae93-24f7e3a06199", "value": "24576:jdZZzdCJvkYzllNkPbdb9tV2CWCKOJaCXMJph91KOb:jvZzdizzjepb96ifJaC8Jp5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764665266, "uuid": "1e4c169c-791f-4820-bd0e-918350c0697b", "value": 1346048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764665266, "uuid": "af295bed-c846-4895-b806-a9f29b05f8ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665266, "uuid": "50db19f3-b642-432d-8b7a-fdf7dc81ba29", "value": "ORDEN DE COMPRA S.A. A PROCESADORA.. .pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d53914b-cf5b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764665283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665283, "uuid": "f365bc6e-de48-4134-a3c4-a06a93b1a0e0", "comment": "Malware payload", "value": "7f55398c6529c0ecae650fc066067fb8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665283, "uuid": "5d097169-c3e6-4bf0-bcb0-2b3af80b381d", "comment": "Malware payload", "value": "f8b359cfac173bae3739ed37062f960c16cec2713aafed1214dad19efa393c5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665283, "uuid": "dee32e51-648a-4a51-8355-afd2bc110847", "comment": "Malware payload", "value": "1a62032b979a95b2e6e57159e0dd17e7c32308c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665283, "uuid": "132f4428-f2f1-4d56-8d4a-01ea71617d80", "comment": "Malware payload", "value": "3faef362892959142eab74f96ba539f33ba3fd67f9501e96124d3ef21f27aa6081fddcd609d4fac40dcb46bd3e083c95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665283, "uuid": "e651cfbe-54c2-41a7-8480-85911bd7ccbd", "value": "T1B8A418B1F785C8A6FCA213748833DC3721AFBD6954B1461E526F3628BA73373506A907", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665283, "uuid": "a0f37a59-2a8c-4703-8e64-a193754fabc2", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665283, "uuid": "62235801-4d66-46b1-b246-cc96063c37b2", "value": "3072:C+KtvoZ37VnuTLKQqu6/6WqMV62Koyo7Jv+6nN4GwXRf9OJd4uj:C+MvoJieOkdnj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764665283, "uuid": "22372f9b-37db-4698-b088-f31e33670399", "value": 475352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764665283, "uuid": "6e833f7c-6244-45ef-845d-54b64b61f89a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665283, "uuid": "685464fe-bc0b-4544-a7cf-1a7ccc4499a9", "value": "Skibsladningens.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83ae0514-cf74-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1764675978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764675978, "uuid": "ec6dc2b3-288d-4122-8777-e029256c2ad1", "comment": "Malware payload (Formbook)", "value": "02e9f898eb325df9d19a770186fdf0ef", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764675978, "uuid": "97be4518-5e38-478a-b9cf-e098cf1b794b", "comment": "Malware payload (Formbook)", "value": "f9430e6f7fd4b2b62103cefb6766ce04b07e1be79b24ee7cdab934b913388335", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764675978, "uuid": "1815fcad-6de6-4cba-82d4-13f88cec574a", "comment": "Malware payload (Formbook)", "value": "0d137883d7649e42280ff5627c963ed6980fbc28", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764675978, "uuid": "b90861ab-fb24-456a-8e09-3d4730c0971b", "comment": "Malware payload (Formbook)", "value": "c2a7776920b1f9e850b3a14f596693a6e84bdccd2f8c1ca4736030e5cde6b97e0022e6ae86303fe6053a0daa4bc56a8a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764675978, "uuid": "46468d23-fe96-4928-bbbe-d2e0a48a3a80", "value": "T1A7250380C78CD145462A330C9EE4A714F6A7481FE742634C3E247DE66F2985AC335DAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764675978, "uuid": "e33e0a0f-4f05-4de0-b2da-05e70d733443", "value": "24:t9srsS/kqlIxg4L8gd9sCLcAzHnCJseJseJseJseJseJseJseJseJseJseJseJsV:lT33K47", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764675978, "uuid": "96f79aba-f8cd-4b13-9c7e-23aaaff3195a", "value": 1053920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764675978, "uuid": "00c834e1-509c-45c8-9d01-b5dd2f8b77da", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764675978, "uuid": "24fafaa1-e799-4898-be7b-2fbafee9398d", "value": "Import Duty and Tax Invoices - GlobalDHLDocuments.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ddb44f8-cf90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764687994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764687994, "uuid": "3f5244da-7740-4034-bd6a-6aa4482f1474", "comment": "Malware payload (Mirai)", "value": "2cc6199b2e294201d0ca52c6abb0c89d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764687994, "uuid": "ad49e3bd-401e-44bc-b8d7-3049851f25eb", "comment": "Malware payload (Mirai)", "value": "f96b0691d85e12b72e979b34a742b6a1b1151744d1fec6ab28a9a231aa59104f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764687994, "uuid": "3b7864e8-b389-4b41-8243-85a577169fcc", "comment": "Malware payload (Mirai)", "value": "2bb74ee117f13b7c2ebf7f246f446ab09d8361de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764687994, "uuid": "bb3fd042-3212-4739-bdc9-f3fcb2c5f048", "comment": "Malware payload (Mirai)", "value": "459379821d9801207cff60da933c7e653f03b419c3ef7ebe3cbb388dc1008349f5dfa8296199622b29321f23bde23772", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764687994, "uuid": "f0edb441-6a8f-49dc-a753-9b9d3b7ae4f8", "value": "T13D92D07242D1B831C7E588BC6764C8C256EA83B8C0F5B0733B60589C79D968B64B5BE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764687994, "uuid": "614c8162-3e73-40a3-8720-4544dc0a8452", "value": "384:FfeE5IsnWceY6zl1YxCilEcbbmSm66h+xlOCu8hymdGUop5h7r:FRIFcZDsw1bb16h4lOCvs3Uoz9r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764687994, "uuid": "a3351817-9468-4d92-a4e8-c2bb1ae02249", "value": 19720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764687994, "uuid": "c66f95c4-616c-4206-865b-5910a6d3a776", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764687994, "uuid": "d0784f20-f400-4db7-a9df-d570f7942367", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d53b074-cf61-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1764667726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764667726, "uuid": "bda7f42e-aa0f-4d0d-b112-008ac39fca8e", "comment": "Malware payload (Formbook)", "value": "7cf89f0a2d68c6afaecf2cde94c075f7", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764667726, "uuid": "88484bea-5d1b-40a3-bd41-1d216c6f1d46", "comment": "Malware payload (Formbook)", "value": "fa21d10369edee9e42442fe0f4c4495e2a2120d69902ab039fd32d839bf223ae", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764667726, "uuid": "35b9ac92-2eff-4279-94b1-bbd42f3d2405", "comment": "Malware payload (Formbook)", "value": "a32b8780eda03a18f3481a1d3369de7c244eed71", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764667726, "uuid": "63ddc28c-613e-434e-9474-42b1281493e5", "comment": "Malware payload (Formbook)", "value": "bd4eae11a4ecb4df5b634d40b6bd9da28a9c5d5433d9b5e9642cf34778d902260648aaf2536b5afe390c08800fa0bc6c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764667726, "uuid": "64067d4c-4b5e-4192-8a6c-aca3bac07f57", "value": "T1E7D423511AB55EE34B75A92D26F8C378790B1313B3F742A864F09DC1B5E7E18B0C3A62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764667726, "uuid": "609789c9-3c8f-4f4a-81a3-11ca18ccfd4d", "value": "12288:eUPIOPSIfVDA1I/yMoqwK1Q48BBJk0yNvzkNM0MiTDJOl4hQQW7E09cBvFZq13:TPdHfS23vwK1yB6RkTwcV2ivC3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764667726, "uuid": "1a01fba2-fb50-4ca0-a99c-ae3bc5a444c6", "value": 635994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764667726, "uuid": "46484444-07c0-4904-a2d0-b322dbff4847", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764667726, "uuid": "43c178e1-e385-462b-b0a6-bd87e640a7cd", "value": "New Order.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aca85e36-cf5b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764665309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665309, "uuid": "822bb262-51cc-484d-9c88-fa01b1dca91a", "comment": "Malware payload", "value": "5f68bf6870780cec3a060a085ebc17a1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665309, "uuid": "abbdf75d-fc70-48a1-9f27-8b291545a6cc", "comment": "Malware payload", "value": "fae86a088e04f05fe0e3c8d5b8cd2945790d484cde61ee840a1b3e7a75ae5ae8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665309, "uuid": "58ba5610-a652-4e39-81ec-d9a7e3753678", "comment": "Malware payload", "value": "a8a05310fa1b1c0c8c039445b9ae261ab5302be2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665309, "uuid": "dfc8973b-e560-4ee4-b76d-42db034c5d87", "comment": "Malware payload", "value": "5b5450219483539953da3d5629327da2d41450718fa22c3e7eb46718ce159c7fefeb485e07186242824e37d0db2627ad", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665309, "uuid": "00766f3f-822e-42ee-af8c-6048984be7be", "value": "T1A44503EC2FFCE126C4A09BEC1FCC53499964931E18938677B16EE9D49F285508422A7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665309, "uuid": "3dda6350-6829-4122-aad0-958fefc4b3fd", "value": "12:NQYpEWAaa4WLkYVvDzrKB79zIcUNN8kgWc3BGuFQTABclASQl:WwzWLkazw79zIc+OycB+oc6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764665309, "uuid": "fbd2b8f9-97d0-4982-9681-9d0d63015640", "value": 1204418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764665309, "uuid": "9bd44c5b-f2dd-474e-8927-a8c77574f1fc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665309, "uuid": "c33c3024-9a91-4cad-b5cd-68f43cec191d", "value": "Purchase Inquiry - SIMSCO251201-122.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afc7df25-cfa3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764696238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696238, "uuid": "7d575c9c-331c-40d6-8382-296af8597de7", "comment": "Malware payload (Mirai)", "value": "a0e439dd1685410e2b5e8c829082324a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696238, "uuid": "305a22ee-82b8-4c95-b48f-75d1fb535b05", "comment": "Malware payload (Mirai)", "value": "fbcc42e851e7348f826b49a2b2803eb116c5df0d97cbc9e80f8d4763d859adde", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696238, "uuid": "2f01e74a-1773-469d-87e2-a0b7ca26106c", "comment": "Malware payload (Mirai)", "value": "c31a64449fb61a37006d2339f861ee9aa9d06259", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764696238, "uuid": "c5f09579-e430-4762-9d0c-fbf05b48f40b", "comment": "Malware payload (Mirai)", "value": "744465d518cd780cac88c9694a969c5accd57b66536688ec048cefca4376022e887781dbfaee4eb723658cc59231e719", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696238, "uuid": "6fef1a99-b8d1-41c9-bd73-d6e1a8c5313a", "value": "T159B35A48F787C1F0F68395B1012BD7B72A748926A026FAD5FF893771F8326529D1A21C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696238, "uuid": "3a424747-50d9-4237-b8c4-1d79412eee64", "value": "1536:EakoV5eKAqAD1WcuExlypmneMQpb/QUy1XuxwEvFwVdrPxCyZqgJ9saUBeaorSCX:lUq2WgxQmneBbA+TcrPxBjJCaUBQSCX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764696238, "uuid": "b92f1639-c020-42c0-9416-22e4e28fc4de", "value": 115996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764696238, "uuid": "8ff3f807-d682-42c2-9e11-d9744e0bd9ff", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764696238, "uuid": "c9b0f107-2b1b-4d84-b601-c631b5dcfd9f", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9812c41d-cf5b-11f0-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1764665274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665274, "uuid": "8aa59352-6739-4741-9038-bfb5ddc97a1c", "comment": "Malware payload (GuLoader)", "value": "c33e33d2373ea77fff877873f3036713", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665274, "uuid": "bfb87537-4899-4908-bb67-094f0ff6504f", "comment": "Malware payload (GuLoader)", "value": "fbe7554867d49dbfa125b8d9355f345319536cbc4016948d4fff8ff0c4fa0b9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665274, "uuid": "fb118c60-b2f5-4484-bf76-89ec365593c0", "comment": "Malware payload (GuLoader)", "value": "d5ccbb5c2130a0fd88bc109ad11db9897017343f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665274, "uuid": "edb6e477-1c09-4915-93ab-cf01584be917", "comment": "Malware payload (GuLoader)", "value": "1021719a0f8377df9d901209e21ce383e53895e571dc7d75ab5faa89aa4c3285845e6aaf0ec7351d3b5cb456a8bef54f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665274, "uuid": "7876427e-018a-408d-b712-555b72a5f1d6", "value": "T1389402C5F6A1A1E7F031487F152ACFB20AA77F751111D3222664F72F2972292EA33653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665274, "uuid": "dafa0016-92fe-4fce-a997-17d50ef576c4", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665274, "uuid": "cd1ac680-4372-4751-b771-8749eff0454f", "value": "12288:/+Uef4GF4qvYpb9MgJnE+dW/g/6sJsghiyl/+Gfe28:/+pJF4gYpqgJnE+I/g/6sJs0/MGfep", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764665274, "uuid": "c2403a01-e232-4b22-9911-04f4335ca3a0", "value": 437208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764665274, "uuid": "01cb01f7-73b1-4a6e-9a81-010c123a9bbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665274, "uuid": "cf265f96-7e7c-452f-9949-021707c5708b", "value": "Proforma Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6002b352-cfb3-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1764702976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764702976, "uuid": "9e54e6ce-b583-4cfa-9ce6-db363dd5055f", "comment": "Malware payload (RustyStealer)", "value": "f72c1c6f9f8a2f05cbf16ae8366de3c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764702976, "uuid": "682a6679-b20b-44ab-8346-c47b8e7cbb6f", "comment": "Malware payload (RustyStealer)", "value": "fd3d092f9536c467253cc98fb68ce5447862c44c940041aa9734485ffd8088e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764702976, "uuid": "7a01f363-5434-41cd-940b-1155ba6ee93e", "comment": "Malware payload (RustyStealer)", "value": "ce90614c84e16827d23301f843d61b103992e966", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764702976, "uuid": "27b8d197-5538-410a-b9fe-5df1980018c7", "comment": "Malware payload (RustyStealer)", "value": "10e4bb57af4847c099c3645156edec9396c08d16154cb5d59446d954ec97c4d52daa4c726e05558c1f4f3dd3ef526fdd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764702976, "uuid": "b7f8c0bf-205a-4cd5-8d24-587fa2e8872d", "value": "T131773322F9A0947FD5CA94B8878676F67062F2C80731CEDF0A55473F6A9C8E18B3D614", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764702976, "uuid": "198dfb67-e206-4424-aa28-41081563011c", "value": "2b5f3b84d2981fa577e3a65d4185a33d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764702976, "uuid": "04cfdfd1-4c61-4176-8aa1-afa27a0e7f98", "value": "786432:fpmXy5ubSgL8xZwEm1+R7sD0h2Lgje8jM:f8C59s6w8sQ6YjM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764702976, "uuid": "7200d897-2e25-4762-b50a-f4d9f80b80d6", "value": 35960320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764702976, "uuid": "cc4b5cfe-4618-49be-a2c1-b75c4fdae888", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764702976, "uuid": "53e05a15-5246-455c-a1a8-11ad38acffe0", "value": "goonvideo.mp4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e27037a-cfaf-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764701255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764701255, "uuid": "197f216f-968f-4958-9b4f-2154999b4969", "comment": "Malware payload", "value": "6e99add3fd325ff54991199f9e803ed4", "object_relation": "md5", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764701255, "uuid": "693834fe-d808-43c5-9d9a-eac56adab38a", "comment": "Malware payload", "value": "fd85fccaffaa94cd2f4ebf10eb8caf631146e96f698ab757c72b1d0d9116d993", "object_relation": "sha256", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764701255, "uuid": "e2209174-b117-47ec-b766-f5cd9dece30d", "comment": "Malware payload", "value": "3ec3d7bed1e620b8d7790b50292e800615c0d6c3", "object_relation": "sha1", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764701255, "uuid": "f5e2c357-8120-4155-8fdf-da9defcf66d1", "comment": "Malware payload", "value": "463acfaec607e00edd982ddfea2c8b479bc3cdff2d8942bb02f948b795c55422ce9e5abca7d39962dd23809058cc6789", "object_relation": "sha3-384", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764701255, "uuid": "6709f051-1846-43fd-9344-1d73f4e15bf8", "value": "T1560633B386998276C067C7B166B642AAC637FC0184B35ED8E1DC9B5CDF10941C2BE763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764701255, "uuid": "28164f59-0ca9-4b6d-aec3-7f482835eeb1", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764701255, "uuid": "4e888980-ba9b-4cbc-8ced-2ad694b99af5", "value": "98304:MSEQoRXd5+9PJILKmimkjKasf0MuFn8HNv4bn:efRXdimbjMMCUW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764701255, "uuid": "458cd55b-2e46-4408-98f4-4b827b001356", "value": 3743493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764701255, "uuid": "fb943974-09c3-4605-ae88-38e7b3f67eae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764701255, "uuid": "4a00a115-5800-4bf6-8622-9aa9a88866c5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0683f0b7-cf94-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764689511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689511, "uuid": "eaeed526-3c0c-4718-a5ee-9ceb2cb6c533", "comment": "Malware payload (Mirai)", "value": "3799f611d4aedcf47e3db6a90cb4dcbc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689511, "uuid": "7455662e-8d5d-406c-819e-8c6ec4c0c552", "comment": "Malware payload (Mirai)", "value": "fdb14bd88e4d7743bebb9012b92c8ca41755a8f25912456816c6641a1a3d178d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689511, "uuid": "7ddcc9b4-5e6e-401c-8d47-71a5270939ab", "comment": "Malware payload (Mirai)", "value": "583eb28552bc90d776431660941e4a2805fafe46", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764689511, "uuid": "377c5107-bc1e-4290-8990-ab95e875cbc9", "comment": "Malware payload (Mirai)", "value": "c0f55b2b8c3e6d238fd53610a275c623a36390fdb95f5d4c0604679615e97c6280e443dad0b75eac2cbdb6309ce00c2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689511, "uuid": "ef1bc814-bbfa-4271-9e02-06c7b6492dc8", "value": "T18A13F260357E3627AF52843CB6E5C6855F8E0DF4E6F3226004A5B7ACE7C2C0116B94CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689511, "uuid": "f02388dc-2e3e-4e50-9329-a6d4b9a63363", "value": "768:6cx7wO4TL+l1TI50u47AGdNe2XQ+6dlDVFV4quqC84qSDaivd8fcxu6JWs3Uoze:6cx7wpLIM50uiLdNJApdl69qCPDVFxu3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764689511, "uuid": "46467554-fc56-47da-92cc-d11cbc3206af", "value": 45400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764689511, "uuid": "52cfe2f0-bc95-4b64-9f21-f8787c73e798", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764689511, "uuid": "3b34b755-24b0-4a90-972d-18bc94f4874f", "value": "ecco.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9787a5b5-cf2f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764646376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646376, "uuid": "c9a617a8-d81f-48b8-bd8e-2ebc502c4571", "comment": "Malware payload (Mirai)", "value": "2a58b121ab45ecb3a278643648b3e860", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646376, "uuid": "c52ed0e5-eb04-4e7b-af5b-d182f04bb06b", "comment": "Malware payload (Mirai)", "value": "fe0e9b4714e509ab3487e881cb1e8e50fa9087b04c0bd603860ec2c66da7ea99", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646376, "uuid": "f065e462-7343-4eee-8307-f602eacd2699", "comment": "Malware payload (Mirai)", "value": "1ac14adddfa939674d75753c5e7ec9676cd18f56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764646376, "uuid": "989247f4-2ef9-4e75-94e3-35c29e579ffc", "comment": "Malware payload (Mirai)", "value": "b1d294df0f7204efbbb38a547a565cd0e1cd91c2130a1e51c451bea4b710f08d8ff81c94eb00e41cba67103fdad564e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646376, "uuid": "1f030684-82bc-4c42-a05e-0ac7f78ff115", "value": "T11563841A3E119FBDFBAC863887B79E20964837D616F1D584D15CEE005E7038E681FB98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646376, "uuid": "d1829e23-ae53-49c5-9ef4-2bd0c0b19646", "value": "1536:pkVpeIaQCztEE1tNgTLUm/0GXCw3bVVm3R7dZbpM48B:WVUI55WNeUmj1bV0zLI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764646376, "uuid": "4164eb08-915e-4488-bf34-c2eb44f390df", "value": 68260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764646376, "uuid": "ab366ab5-e1ba-488b-927b-e123ca85f92c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764646376, "uuid": "7fb0ae18-c557-4f46-b07d-1df491ab5e54", "value": "3atoNational.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bc7d0c1-cf3c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764651939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764651939, "uuid": "e26f597f-92d0-462b-9612-b215c28e207e", "comment": "Malware payload (Mirai)", "value": "bf9c958bc485cdbf5fcb340f71dde340", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764651939, "uuid": "fb8a4a8b-3bc6-46ce-9ddb-d38f837b97eb", "comment": "Malware payload (Mirai)", "value": "fea424aef7b9fe3587189cd515bf01f52f0ce5401476ec23ae8ad35c936ceaff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764651939, "uuid": "ce3901af-34f6-42eb-9426-cc7e4253a2d8", "comment": "Malware payload (Mirai)", "value": "f1522bb14fab3190a4d476093c9d4af7a7e65766", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764651939, "uuid": "aa57f390-7fbf-46b2-891c-b00a4a257028", "comment": "Malware payload (Mirai)", "value": "8c35bd82a62e07b4f38faa5a565d1ec3f0d516fd1a4751a145a155da4bcec0f0483c36de1423a2491ae4ced7f5ac928d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764651939, "uuid": "3fdeb52d-46b6-4200-8d52-ab069497a64b", "value": "T153A36C02735C0D43D1A75DF0263F27E983EEDA9222F4FA89250FDA4681B1E77154AED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764651939, "uuid": "848ad29b-4ee9-4d2d-9e53-a28ed68c9e59", "value": "1536:8s7tl8ho1ybZS99jHw3QVfrHOot0zxiczE0qVe:8shieydS99U0ruoigVe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764651939, "uuid": "66edcfc6-ab38-4e1f-9a04-d0d670e250d5", "value": 99968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764651939, "uuid": "7561b692-e453-4f18-8b9c-085a3fcbd5f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764651939, "uuid": "148a7cf2-6350-4bcb-acbe-861fe8bc86e9", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "960986b2-cf5b-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1764665271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665271, "uuid": "f6aced92-b231-4eea-800d-3b51c916b434", "comment": "Malware payload (AgentTesla)", "value": "abb587c7cab32c2a9e23903c25ec8312", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665271, "uuid": "48da6415-5eb5-470b-8d60-83b2ca98f727", "comment": "Malware payload (AgentTesla)", "value": "ff30d24b652e2bd46709c8b3c0fb8c293172235a02540d7496cf1f4984fe62ab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665271, "uuid": "42d8c60e-54c0-463d-a351-93cf93282dba", "comment": "Malware payload (AgentTesla)", "value": "c0e8483dc4eba9ffd82ec89b5d838e2545bbee67", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764665271, "uuid": "b3cd049a-5a4b-487b-9441-f3a3edb86007", "comment": "Malware payload (AgentTesla)", "value": "9765a55834930429641fec58fcb95f6fae9fb14169d9f398ebfdaf8dad5f4624b8b9c7f2449b3d3d6bc056f06bf48896", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665271, "uuid": "8a199331-61c6-4752-a91d-d46fdcde170e", "value": "T18FE423555BC89D60D61473308832CD605AB4BC319E01773ECB3AE9ABAD343D7E922B9D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665271, "uuid": "893f8a63-a98d-4615-a979-ced4ecb5ffe3", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665271, "uuid": "8c96e921-6d7c-4d0e-b208-c71095b77cef", "value": "12288:nz7hU5I5yuNHIgzSFKxWltRohBfSTso93UbhikILSgtAHopQlKJc4Ky:nf+iN57Gtene3AQnSMT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764665271, "uuid": "4740f745-8462-4579-9433-74259b50e82b", "value": 693248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764665271, "uuid": "70fae796-5003-4af1-9a82-48f1ade2984d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764665271, "uuid": "e18053bd-e4ad-4ac2-87a1-15f89b8f5491", "value": "PO_ASQT2510153810.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }